Microsoft informed its customers on Tuesday that vulnerabilities affecting its cloud, artificial intelligence and other services have been fixed, including a flaw that was used in attacks.
See also: Overflaw vulnerability in Windows 11 allows hackers to escalate privileges
The tech giant has patched vulnerabilities in Azure, Copilot Studio , and its Partner Network website, but users don't need to take any additional action. The CVE IDs and advisories have been published for transparency purposes only.
Microsoft has published separate advisories for each vulnerability. All are described as privilege escalation issues that have a maximum severity rating of "critical," but based on the CVSS score, two of them have a "high severity" rating and only one is actually "critical."
On the Partner Network website, specifically in the “partner.microsoft.com” domain, Microsoft addressed CVE-2024-49035, a high-severity improper access control vulnerability that could allow an unauthenticated attacker to elevate network privileges.
See also: Command Injection vulnerability in Kemp Load Balancer
The vulnerability has been marked as «exploitation» and Microsoft confirmed to SecurityWeek that indeed exploitation was detected, but it would not disclose additional information.
Two Microsoft employees and an anonymous researcher have been credited for finding the vulnerability.
There appear to be no public reports describing the exploit of the flaw, and some industry members believed that the issue may have been flagged as exploitable in error.
The domain partner.microsoft.com is listed as out of scope in Microsoft's bug bounty programs.
The critical severity issue addressed this week is CVE-2024-49038, a cross-site scripting (XSS) vulnerability in Copilot Studio, a product that uses generative artificial intelligence to allow customers to customize or create copilots.
See also: NVIDIA UFM vulnerability allows hackers to escalate privileges
Patches are critical updates issued to fix security flaws in software or systems. These patches address vulnerabilities that attackers could exploit to gain unauthorized access, compromise data, or disrupt operations. Regular patch application is a fundamental part of maintaining cybersecurity ,ensuring that systems remain robust against emerging threats. Organizations are encouraged to implement patch management processes to identify, test, and deploy patches in a timely manner, reducing potential risks and improving the overall resilience of their infrastructure.
Source: securityweek
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
