Azure Container Registry
Monthly
Authorization bypass in Microsoft Container Registry (MCR) lets an unauthenticated remote attacker supply a manipulated, user-controlled key to reference registry resources they are not authorized to access, producing high confidentiality and integrity impact with a scope change; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) independently computes to a maximum 10.0. Because MCR is a Microsoft-operated cloud service, every tenant and consumer that pulls images, charts, or artifacts from mcr.microsoft.com is potentially exposed through the hosted endpoint rather than through any customer-deployed software. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but the unauthenticated, low-complexity, network-reachable nature of the flaw means the exposure window is determined entirely by how quickly Microsoft remediates server-side.
Azure Virtual Machine Information Disclosure Vulnerability. Rated medium severity (CVSS 6.8), this vulnerability is low attack complexity.
Authorization bypass in Microsoft Container Registry (MCR) lets an unauthenticated remote attacker supply a manipulated, user-controlled key to reference registry resources they are not authorized to access, producing high confidentiality and integrity impact with a scope change; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) independently computes to a maximum 10.0. Because MCR is a Microsoft-operated cloud service, every tenant and consumer that pulls images, charts, or artifacts from mcr.microsoft.com is potentially exposed through the hosted endpoint rather than through any customer-deployed software. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but the unauthenticated, low-complexity, network-reachable nature of the flaw means the exposure window is determined entirely by how quickly Microsoft remediates server-side.
Azure Virtual Machine Information Disclosure Vulnerability. Rated medium severity (CVSS 6.8), this vulnerability is low attack complexity.