Azure Logic Apps
Monthly
Information disclosure in Microsoft Azure Logic Apps allows an authenticated, low-privileged attacker to read data they should not have access to across a network, with a scope-changed CVSS 3.1 score of 9.6 reflecting potential cross-boundary (multi-tenant) impact. The flaw stems from improper access control (CWE-284) in the cloud workflow-automation service; Microsoft is the reporter and remediation is delivered service-side. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, though the high score and scope change warrant prompt attention.
Privilege escalation in Microsoft Azure Logic Apps allows an authenticated attacker with low-level privileges to elevate their permissions over the network via improper access control (CWE-284). The CVSS 9.9 score is driven by a scope change (S:C), meaning a successful attack breaches the security boundary of the vulnerable component and impacts other resources with full confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis, and EPSS probability is low (0.06%), consistent with CISA SSVC rating exploitation as 'none'.
Privilege escalation in Azure Logic Apps results from improper path validation, enabling remote attackers to gain elevated access without authentication or user interaction. Organizations using Azure Logic Apps are at risk of unauthorized privilege elevation through network-based attacks, with no available patch currently provided.
Microsoft Power Platform Connector Spoofing Vulnerability. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Information disclosure in Microsoft Azure Logic Apps allows an authenticated, low-privileged attacker to read data they should not have access to across a network, with a scope-changed CVSS 3.1 score of 9.6 reflecting potential cross-boundary (multi-tenant) impact. The flaw stems from improper access control (CWE-284) in the cloud workflow-automation service; Microsoft is the reporter and remediation is delivered service-side. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, though the high score and scope change warrant prompt attention.
Privilege escalation in Microsoft Azure Logic Apps allows an authenticated attacker with low-level privileges to elevate their permissions over the network via improper access control (CWE-284). The CVSS 9.9 score is driven by a scope change (S:C), meaning a successful attack breaches the security boundary of the vulnerable component and impacts other resources with full confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis, and EPSS probability is low (0.06%), consistent with CISA SSVC rating exploitation as 'none'.
Privilege escalation in Azure Logic Apps results from improper path validation, enabling remote attackers to gain elevated access without authentication or user interaction. Organizations using Azure Logic Apps are at risk of unauthorized privilege elevation through network-based attacks, with no available patch currently provided.
Microsoft Power Platform Connector Spoofing Vulnerability. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity.