Summary
Impact: Spoofing. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
According to the CVSS metric, successful exploitation of this vulnerability could lead to total loss of confidentiality (C:H)? What does that mean for this vulnerability?
This vulnerability discloses a user's JSON web token to the attacker.
According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
The user would have to click on a specially crafted URL to be compromised by the attacker.
How do I get the security update for Azure Data Explorer?
You need to restart the Kusto.Explorer application. The update will be automatically downloaded.
Release notes for the update are available in the application menu under Help->What’s new, under the applicable Version.
According to the CVSS metric, successful exploitation of this vulnerability could lead to total loss of integrity (I:H)? What does that mean for this vulnerability?
The compromised JSON web token can be used to compromise accounts and modify account information.
Vulnerabilities 1
-
High 8.1
Azure Data Explorer Spoofing Vulnerability
Azure Data Explorer Spoofing Vulnerability
Revision history
-
#1
Information published.
References
-
CVE-2022-23256 Azure Data Explorer Spoofing Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23256
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss