Power Platform
Monthly
Privilege elevation in Microsoft Power Automate (Power Platform cloud service) lets an authenticated, low-privileged attacker abuse a server-side request forgery flaw (CWE-918) to make the service issue requests to internal/backend endpoints, resulting in a scope-changing escalation with total confidentiality, integrity, and availability impact. The CVSS 3.1 base score is 9.9 with a changed scope, reflecting that the SSRF crosses a trust boundary into resources beyond the vulnerable component. No public exploit identified at time of analysis, and EPSS is low (0.33%, 26th percentile), consistent with CISA SSVC marking exploitation as 'none'.
Missing authorization in Power Platform allows an unauthenticated attacker to view sensitive information through a network attack vector. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An authenticated attacker can exploit an untrusted search path vulnerability in Microsoft Dataverse to execute code over a network. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Microsoft Power Platform Connector Spoofing Vulnerability. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Privilege elevation in Microsoft Power Automate (Power Platform cloud service) lets an authenticated, low-privileged attacker abuse a server-side request forgery flaw (CWE-918) to make the service issue requests to internal/backend endpoints, resulting in a scope-changing escalation with total confidentiality, integrity, and availability impact. The CVSS 3.1 base score is 9.9 with a changed scope, reflecting that the SSRF crosses a trust boundary into resources beyond the vulnerable component. No public exploit identified at time of analysis, and EPSS is low (0.33%, 26th percentile), consistent with CISA SSVC marking exploitation as 'none'.
Missing authorization in Power Platform allows an unauthenticated attacker to view sensitive information through a network attack vector. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An authenticated attacker can exploit an untrusted search path vulnerability in Microsoft Dataverse to execute code over a network. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Microsoft Power Platform Connector Spoofing Vulnerability. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity.