Azure Cosmos Db
Monthly
Authorization bypass via user-controlled key in Azure Cosmos DB enables an authenticated attacker to perform cross-account spoofing over the network, potentially accessing or manipulating data belonging to other accounts or tenants. Exploiting CWE-639 (IDOR-class flaw), an attacker with a valid Cosmos DB account can supply a crafted key to circumvent per-resource authorization checks, yielding full confidentiality, integrity, and availability impact per the CVSS vector. No public exploit code has been identified and SSVC confirms no active exploitation, though CVSS impact metrics indicate total technical impact if successfully triggered.
Remote code execution in Microsoft Azure Cosmos DB allows an unauthorized, unauthenticated attacker to execute code over a network by abusing an improper access control (authentication bypass) flaw. Microsoft rates it CVSS 10.0 with a scope change, meaning a successful attack against the managed database service can impact resources beyond the initially vulnerable component. No public exploit has been identified at time of analysis (CVSS exploit maturity is Unproven), and it is not on the CISA KEV list, but the maximum severity and network-reachable, no-privilege profile make it a top-priority fix.
Authorization bypass via user-controlled key in Azure Cosmos DB enables an authenticated attacker to perform cross-account spoofing over the network, potentially accessing or manipulating data belonging to other accounts or tenants. Exploiting CWE-639 (IDOR-class flaw), an attacker with a valid Cosmos DB account can supply a crafted key to circumvent per-resource authorization checks, yielding full confidentiality, integrity, and availability impact per the CVSS vector. No public exploit code has been identified and SSVC confirms no active exploitation, though CVSS impact metrics indicate total technical impact if successfully triggered.
Remote code execution in Microsoft Azure Cosmos DB allows an unauthorized, unauthenticated attacker to execute code over a network by abusing an improper access control (authentication bypass) flaw. Microsoft rates it CVSS 10.0 with a scope change, meaning a successful attack against the managed database service can impact resources beyond the initially vulnerable component. No public exploit has been identified at time of analysis (CVSS exploit maturity is Unproven), and it is not on the CISA KEV list, but the maximum severity and network-reachable, no-privilege profile make it a top-priority fix.