CVE-2024-38206CWE-918

Microsoft Copilot Studio Information Disclosure Vulnerability

High · published August 6, 2024

CVSS v3.1

8.5

EPSS

12%

Percentile

96.2

In the wild

Unconfirmed

What it is

An authenticated attacker can bypass Server-Side Request Forgery (SSRF) protection in Microsoft Copilot Studio to leak sensitive information over a network.

The record

Technical detail

CVSS v3.1: 8.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N/E:U/RL:O/RC:C
CVSS v4.0: Not supplied
EPSS: 0.12341 · 96.2th percentile
Weakness: CWE-918 · Server-Side Request Forgery (SSRF)
Published: 2024-08-06T21:38Z

EPSS history

Timeline

06 AUG 21:38Z
Microsoft Copilot Studio Information Disclosure Vulnerability
cvelistv5