Vulnerabilities fixed in Microsoft Azure

🗓️ 13 May 2025 19:10:10Reported by NCSCType

Azure fixed vulnerabilities enabling impersonation, privilege escalation, and data access; updates released for four CVEs; no action required.

Reporter	Title	Published	Views	Family All 86
GithubExploit	Exploit for Server-Side Request Forgery in Microsoft	9 Jun 202506:46	–	githubexploit
GithubExploit	Exploit for Server-Side Request Forgery in Microsoft	25 Mar 202517:59	–	githubexploit
BDU FSTEC	The vulnerability of the Azure Automation service, related to incorrect authorization, allows a perpetrator to increase their privileges.	14 May 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Azure Storage Resource Provider package, due to insufficient validation of server-side requests, allows a attacker to execute an SSRF attack.	14 May 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Microsoft Azure File Sync data synchronization service, related to access control deficiencies, allows attackers to escalate their privileges.	18 May 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of Azure AI Document Intelligence, a cloud-based AI service, arises from an incorrect restriction on the path to the restricted access catalog. This allows attackers to escalate their privileges.	19 May 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the testing tool for Microsoft Windows Hardware Lab Kit (HLK) operating systems allows a hacker to exploit their privileges.	23 May 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Microsoft Power Apps development environment, related to insufficient validation of incoming requests, allows a attacker to execute an SSRF attack.	3 Jun 202500:00	–	bdu_fstec
Circl	CVE-2025-27488	13 May 202516:27	–	circl
Circl	CVE-2025-29827	8 May 202522:25	–	circl

13 May 2025 19:10Current

8.5High risk

Vulners AI Score8.5

CVSS 3.19.8 - 9.9

EPSS0.05726

SSVC