Azure Machine Learning
Monthly
Spoofing in Microsoft Azure Machine Learning (versions 3.0.0 up to but not including 1.7.6) lets an unauthenticated network attacker inject improperly neutralized special elements into output rendered by a downstream component, enabling them to impersonate trusted content or identities against a victim who interacts with the malicious output. The CVSS 3.1 base score is 8.2 with a scope change and high confidentiality impact, but real-world urgency is tempered by an EPSS of just 0.05% (15th percentile) and CISA SSVC rating exploitation as 'none'. There is no public exploit identified at time of analysis and the issue is not on the CISA KEV list.
Improper authorization in Azure allows an authorized attacker to elevate privileges over a network. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Azure Machine Learning Information Disclosure Vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity.
Azure Machine Learning Compute Instance Information Disclosure Vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Spoofing in Microsoft Azure Machine Learning (versions 3.0.0 up to but not including 1.7.6) lets an unauthenticated network attacker inject improperly neutralized special elements into output rendered by a downstream component, enabling them to impersonate trusted content or identities against a victim who interacts with the malicious output. The CVSS 3.1 base score is 8.2 with a scope change and high confidentiality impact, but real-world urgency is tempered by an EPSS of just 0.05% (15th percentile) and CISA SSVC rating exploitation as 'none'. There is no public exploit identified at time of analysis and the issue is not on the CISA KEV list.
Improper authorization in Azure allows an authorized attacker to elevate privileges over a network. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Azure Machine Learning Information Disclosure Vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity.
Azure Machine Learning Compute Instance Information Disclosure Vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.