Discovery Studio
Monthly
NoSQL injection in Microsoft Discovery Studio enables unauthenticated, network-based attackers to extract confidential data from the application's backend data store. The CWE-943 flaw allows specially crafted query inputs to bypass intended data-access boundaries, with the CVSS scope-change (S:C) indicating that leakage can extend beyond the directly targeted component - potentially exposing data belonging to other users or system contexts. Exploitation requires user interaction (UI:R), constraining opportunistic mass attacks; no public exploit code and no CISA KEV listing have been identified at time of analysis.
NoSQL injection in Microsoft Discovery Studio enables unauthenticated, network-based attackers to extract confidential data from the application's backend data store. The CWE-943 flaw allows specially crafted query inputs to bypass intended data-access boundaries, with the CVSS scope-change (S:C) indicating that leakage can extend beyond the directly targeted component - potentially exposing data belonging to other users or system contexts. Exploitation requires user interaction (UI:R), constraining opportunistic mass attacks; no public exploit code and no CISA KEV listing have been identified at time of analysis.