CVE-2025-47733CWE-918

Microsoft Power Apps Information Disclosure Vulnerability

Critical · published May 8, 2025

CVSS v3.1
9.1
EPSS
2%
Percentile
80.5
In the wild
Unconfirmed
What it is

🚨 A simple request is all it takes to expose sensitive information from your network! This SSRF in Microsoft Power Apps is a serious threat that could give unauthorized attackers a peek behind your digital curtain. 🔥 Think of it like a nosy neighbor who tricks you into opening your door by asking for a package delivery—once they’re in, they can see everything inside your house without you realizing it! If exploited, an attacker can access internal data and services, potentially compromising your entire network. This could lead to devastating data breaches, exposing confidential information that should remain secure. It’s a critical vulnerability that needs immediate attention!

Put simply

Think of it like a nosy neighbor who tricks you into opening your door by asking for a package delivery—once they’re in, they can see everything inside your house without you realizing it! The SSRF vulnerability in Microsoft Power Apps allows attackers to send crafted requests to internal resources, bypassing access controls and revealing sensitive data over the network.

What to do

If exploited, an attacker can access internal data and services, potentially compromising your entire network. This could lead to devastating data breaches, exposing confidential information that should remain secure. It’s a critical vulnerability that needs immediate attention! To tackle this head-on, ensure you update Power Apps to the latest patched version immediately. Additionally, implement strict input validation and network restrictions to minimize exposure to this threat. Regularly audit your configurations for potential vulnerabilities! You've got this! Stay proactive and secure your apps, and you'll keep those cyber villains at bay! 🛡️

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.01993 · 80.5th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2025-05-08T22:17Z
EPSS history
Timeline
  • 08 MAY 22:17Z
    Microsoft Power Apps Information Disclosure Vulnerability
    cvelistv5