Azure Logic Apps
Monthly
Improper access control in Microsoft Azure Logic Apps allows an unauthenticated remote attacker to elevate privileges over the network, gaining high confidentiality and integrity impact against the affected service. The flaw rates CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), meaning the vector assumes no privileges and no user interaction are needed, though Microsoft's use of "elevate privileges" in the description hints that some pre-existing tenant or service context may be required - a discrepancy worth verifying against the MSRC advisory. There is no public exploit identified at time of analysis: EPSS is 0.45% (39th percentile), CISA SSVC records exploitation as "none," and no KEV listing exists, but SSVC rates the issue fully automatable with total technical impact.
Path traversal in Microsoft's Azure Logic Apps (CWE-22) lets a remote, unauthenticated attacker escape an intended restricted directory and elevate privileges over the network, with the vendor's CVSS 9.8 score reflecting high confidentiality, integrity, and availability impact under a PR:N/UI:N vector. The defect affects the hosted Azure Logic Apps service rather than a versioned on-premises component, and Microsoft's advisory does not disclose the specific endpoint, feature, or configuration that must be reachable, so the precise triggering surface remains undocumented. No public exploit code has been identified and CISA's SSVC assessment records no observed exploitation (Exploitation: none) while flagging the issue as automatable with total technical impact; EPSS sits at 0.58% (47th percentile), indicating low modeled near-term exploitation likelihood despite the critical base score. Because Logic Apps is a Microsoft-managed cloud service, exposure depends on whether a given tenant region or service instance was remediated centrally rather than on any customer-side patch action.
Privilege elevation in Microsoft Azure Logic Apps allows an unauthenticated, remote attacker to escalate privileges by abusing a path-traversal flaw (CWE-22) that fails to restrict a supplied pathname to its intended directory, provided a victim is lured into interacting (UI:R). Rated CVSS 9.6 with a changed scope, indicating impact beyond the initially vulnerable component. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Information disclosure in Microsoft Azure Logic Apps allows an authenticated, low-privileged attacker to read data they should not have access to across a network, with a scope-changed CVSS 3.1 score of 9.6 reflecting potential cross-boundary (multi-tenant) impact. The flaw stems from improper access control (CWE-284) in the cloud workflow-automation service; Microsoft is the reporter and remediation is delivered service-side. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, though the high score and scope change warrant prompt attention.
Privilege escalation in Microsoft Azure Logic Apps allows an authenticated attacker with low-level privileges to elevate their permissions over the network via improper access control (CWE-284). The CVSS 9.9 score is driven by a scope change (S:C), meaning a successful attack breaches the security boundary of the vulnerable component and impacts other resources with full confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis, and EPSS probability is low (0.06%), consistent with CISA SSVC rating exploitation as 'none'.
Privilege escalation in Azure Logic Apps results from improper path validation, enabling remote attackers to gain elevated access without authentication or user interaction. Organizations using Azure Logic Apps are at risk of unauthorized privilege elevation through network-based attacks, with no available patch currently provided.
Microsoft Power Platform Connector Spoofing Vulnerability. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Improper access control in Microsoft Azure Logic Apps allows an unauthenticated remote attacker to elevate privileges over the network, gaining high confidentiality and integrity impact against the affected service. The flaw rates CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), meaning the vector assumes no privileges and no user interaction are needed, though Microsoft's use of "elevate privileges" in the description hints that some pre-existing tenant or service context may be required - a discrepancy worth verifying against the MSRC advisory. There is no public exploit identified at time of analysis: EPSS is 0.45% (39th percentile), CISA SSVC records exploitation as "none," and no KEV listing exists, but SSVC rates the issue fully automatable with total technical impact.
Path traversal in Microsoft's Azure Logic Apps (CWE-22) lets a remote, unauthenticated attacker escape an intended restricted directory and elevate privileges over the network, with the vendor's CVSS 9.8 score reflecting high confidentiality, integrity, and availability impact under a PR:N/UI:N vector. The defect affects the hosted Azure Logic Apps service rather than a versioned on-premises component, and Microsoft's advisory does not disclose the specific endpoint, feature, or configuration that must be reachable, so the precise triggering surface remains undocumented. No public exploit code has been identified and CISA's SSVC assessment records no observed exploitation (Exploitation: none) while flagging the issue as automatable with total technical impact; EPSS sits at 0.58% (47th percentile), indicating low modeled near-term exploitation likelihood despite the critical base score. Because Logic Apps is a Microsoft-managed cloud service, exposure depends on whether a given tenant region or service instance was remediated centrally rather than on any customer-side patch action.
Privilege elevation in Microsoft Azure Logic Apps allows an unauthenticated, remote attacker to escalate privileges by abusing a path-traversal flaw (CWE-22) that fails to restrict a supplied pathname to its intended directory, provided a victim is lured into interacting (UI:R). Rated CVSS 9.6 with a changed scope, indicating impact beyond the initially vulnerable component. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Information disclosure in Microsoft Azure Logic Apps allows an authenticated, low-privileged attacker to read data they should not have access to across a network, with a scope-changed CVSS 3.1 score of 9.6 reflecting potential cross-boundary (multi-tenant) impact. The flaw stems from improper access control (CWE-284) in the cloud workflow-automation service; Microsoft is the reporter and remediation is delivered service-side. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, though the high score and scope change warrant prompt attention.
Privilege escalation in Microsoft Azure Logic Apps allows an authenticated attacker with low-level privileges to elevate their permissions over the network via improper access control (CWE-284). The CVSS 9.9 score is driven by a scope change (S:C), meaning a successful attack breaches the security boundary of the vulnerable component and impacts other resources with full confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis, and EPSS probability is low (0.06%), consistent with CISA SSVC rating exploitation as 'none'.
Privilege escalation in Azure Logic Apps results from improper path validation, enabling remote attackers to gain elevated access without authentication or user interaction. Organizations using Azure Logic Apps are at risk of unauthorized privilege elevation through network-based attacks, with no available patch currently provided.
Microsoft Power Platform Connector Spoofing Vulnerability. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity.