CVE-2024-38206

2024-08-0622:15:54

CWE-918

microsoft

web.nvd.nist.gov

authenticated attacker

ssrf protection

microsoft copilot studio

sensitive information

network

CVSS3

8.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N/E:U/RL:O/RC:C

AI Score

6.3

Confidence

Low

EPSS

0.001

Percentile

27.8%

JSON

An authenticated attacker can bypass Server-Side Request Forgery (SSRF) protection in Microsoft Copilot Studio to leak sensitive information over a network.

Affected configurations

Nvd

Vulners

Node

microsoftcopilot_studioMatch-

VendorProductVersionCPE
microsoftcopilot_studio-cpe:2.3:a:microsoft:copilot_studio:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
microsoft	copilot_studio	-	cpe:2.3:a:microsoft:copilot_studio:-:::::::*

CNA Affected

[
  {
    "vendor": "Microsoft",
    "product": "Microsoft Copilot Studio",
    "cpes": [
      "cpe:2.3:a:microsoft:copilot_studio:*:*:*:*:*:*:*:*"
    ],
    "platforms": [
      "Unknown"
    ],
    "versions": [
      {
        "version": "N/A",
        "status": "affected"
      }
    ]
  }
]