Azure Stack Hci
Monthly
Azure Stack HCI exposes sensitive information to unauthenticated remote attackers via observable response discrepancy (CWE-204), where the system returns distinguishably different responses to distinct inputs, enabling enumeration or inference of confidential data without credentials. The CVSS 3.1 vector's Changed scope (S:C/C:H) signals that the disclosed information extends beyond the vulnerable component - significant in a hyperconverged platform managing compute, storage, and networking workloads with Azure integration. No public exploit code has been identified at time of analysis, but a vendor patch is available through the Microsoft Security Response Center.
Information disclosure in Microsoft Azure Compute Gallery permits an authenticated remote attacker to read sensitive data across tenant or resource boundaries due to improper input validation (CWE-20). The scope-changed CVSS 7.7 rating reflects cross-boundary impact, but the exploit maturity is currently unproven (E:U) and no public exploit identified at time of analysis. Microsoft has published an official fix via MSRC.
Azure Stack HCI Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. No vendor patch available.
Azure Stack Hyperconverged Infrastructure (HCI) Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
Azure Stack HCI exposes sensitive information to unauthenticated remote attackers via observable response discrepancy (CWE-204), where the system returns distinguishably different responses to distinct inputs, enabling enumeration or inference of confidential data without credentials. The CVSS 3.1 vector's Changed scope (S:C/C:H) signals that the disclosed information extends beyond the vulnerable component - significant in a hyperconverged platform managing compute, storage, and networking workloads with Azure integration. No public exploit code has been identified at time of analysis, but a vendor patch is available through the Microsoft Security Response Center.
Information disclosure in Microsoft Azure Compute Gallery permits an authenticated remote attacker to read sensitive data across tenant or resource boundaries due to improper input validation (CWE-20). The scope-changed CVSS 7.7 rating reflects cross-boundary impact, but the exploit maturity is currently unproven (E:U) and no public exploit identified at time of analysis. Microsoft has published an official fix via MSRC.
Azure Stack HCI Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. No vendor patch available.
Azure Stack Hyperconverged Infrastructure (HCI) Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.