Summary
Impact: Information Disclosure. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
According to the CVSS metric, the attack complexity is high (AC:H). What does this mean for this vulnerability?
The vulnerability enables data leakage only when a user's script is improperly used and triggers specific errors. The conditions required for triggering the error are not easily met making the complexity high.
What type of information could be disclosed by this vulnerability?
The Azure Machine Learning (ML) training data associated with user accounts will be disclosed. This data primarily consists of information used for ML model training purposes within the Azure ML system.
Security updates
1.5.0 — https://pypi.org/project/mltable/1.5.0/
Vulnerabilities 1
-
Medium 4.7
Azure Machine Learning Compute Instance for SDK Users Information Disclosure Vulnerability
Azure Machine Learning Compute Instance for SDK Users Information Disclosure Vulnerability
Revision history
-
#1
Information published.
References
-
CVE-2023-35625 Azure Machine Learning Compute Instance for SDK Users Information Disclosure Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35625
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss