CVE-2024-38206

Published: Aug 6, 2024Modified: Aug 14, 2024

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

An authenticated attacker can bypass Server-Side Request Forgery (SSRF) protection in Microsoft Copilot Studio to leak sensitive information over a network.

Affected (1)

Products: Microsoft: Copilot Studio

Microsoft

1 product

Copilot Studio

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Microsoft Copilot Studio	All versions

Related CWEs

CWE-918

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (1)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38206

Source: secure@microsoft.com

PatchVendor Advisory

Timeline

No history available yet.