Azure Event Grid System
Monthly
Spoofing of trusted event sources in Microsoft Azure Event Grid is possible because the service fails to enforce an authorization check on event publishing and routing operations (CWE-862). Exploitation requires the attacker to already hold a valid, low-privilege identity in the Azure environment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N), so this is not a remote-unauthenticated attack: an authorized principal who can reach the Event Grid endpoint over the network can push events across an authorization boundary they should not cross, undermining the integrity of event-driven workflows. Impact is integrity-only with no confidentiality or availability loss, scope is assessed as changed, no public exploit code has been identified at time of analysis, and because Event Grid is a Microsoft-managed cloud service the fix is applied server-side by the vendor rather than by customers themselves.
Spoofing of trusted event sources in Microsoft Azure Event Grid is possible because the service fails to enforce an authorization check on event publishing and routing operations (CWE-862). Exploitation requires the attacker to already hold a valid, low-privilege identity in the Azure environment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N), so this is not a remote-unauthenticated attack: an authorized principal who can reach the Event Grid endpoint over the network can push events across an authorization boundary they should not cross, undermining the integrity of event-driven workflows. Impact is integrity-only with no confidentiality or availability loss, scope is assessed as changed, no public exploit code has been identified at time of analysis, and because Event Grid is a Microsoft-managed cloud service the fix is applied server-side by the vendor rather than by customers themselves.