Microsoft Planetary Computer Pro Geocatalog
Monthly
Information disclosure in Microsoft Planetary Computer Pro (GeoCatalog) lets a remote, unauthenticated attacker read sensitive data by sending crafted serialized objects that the service deserializes without validation (CWE-502). The flaw carries a CVSS 3.1 score of 7.5 (confidentiality-only impact) and, per SSVC, is automatable but has no observed exploitation; there is no public exploit identified at time of analysis, and EPSS estimates a low 0.27% probability of exploitation in the next 30 days.
Information disclosure in Microsoft Planetary Computer Pro (GeoCatalog) lets a remote, unauthenticated attacker read sensitive data by sending crafted serialized objects that the service deserializes without validation (CWE-502). The flaw carries a CVSS 3.1 score of 7.5 (confidentiality-only impact) and, per SSVC, is automatable but has no observed exploitation; there is no public exploit identified at time of analysis, and EPSS estimates a low 0.27% probability of exploitation in the next 30 days.