Summary
Microsoft heeft kwetsbaarheden verholpen in diverse Azure componenten.
Details
Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om zich voor te doen als andere gebruiker, zich verhoogde rechten toe te kennen en toegang te krijgen tot gevoelige gegevens.
Microsoft heeft inmiddels updates uitgebracht om de kwetsbaarheden te verhelpen met kenmerk CVE-2025-47733, CVE-2025-29972, CVE-2025-29827 en CVE-2025-33072. Deze kwetsbaarheden bevinden zich in online componenten en vereisen geen verdere actie.
```
Azure Automation:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-29827 | 9.90 | Verkrijgen van verhoogde rechten |
|----------------|------|-------------------------------------|
Azure:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-30387 | 9.80 | Verkrijgen van verhoogde rechten |
| CVE-2025-33072 | 8.10 | Toegang tot gevoelige gegevens |
|----------------|------|-------------------------------------|
Azure Storage Resource Provider:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-29972 | 9.90 | Voordoen als andere gebruiker |
|----------------|------|-------------------------------------|
Microsoft Power Apps:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-47733 | 9.10 | Toegang tot gevoelige gegevens |
|----------------|------|-------------------------------------|
Windows Hardware Lab Kit:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-27488 | 6.70 | Verkrijgen van verhoogde rechten |
|----------------|------|-------------------------------------|
Azure File Sync:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-29973 | 7.00 | Verkrijgen van verhoogde rechten |
|----------------|------|-------------------------------------|
```
Oplossingen
Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op:
Vulnerabilities 7
-
Critical 9.9
Azure Automation Elevation of Privilege Vulnerability
Improper authorization in Azure Automation allows an authorized attacker to elevate privileges over a network.
-
Critical 9.9CVE-2025-29972 Public exploit
Azure Storage Resource Provider Spoofing Vulnerability
Server-side request forgery (ssrf) in Azure Storage Resource Provider allows an authorized attacker to perform spoofing over a network.
-
Critical 9.8
Document Intelligence Studio On-Prem Elevation of Privilege Vulnerability
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.1
Microsoft Power Apps Information Disclosure Vulnerability
Server-Side Request Forgery (SSRF) in Microsoft Power Apps allows an unauthorized attacker to disclose information over a network
-
High 8.1
Microsoft msagsfeedback.azurewebsites.net Information Disclosure Vulnerability
Improper access control in Azure allows an unauthorized attacker to disclose information over a network.
-
High 7.0
Microsoft Azure File Sync Elevation of Privilege Vulnerability
Improper access control in Azure File Sync allows an authorized attacker to elevate privileges locally.
-
Medium 6.7
Microsoft Windows Hardware Lab Kit (HLK) Elevation of Privilege Vulnerability
Use of hard-coded credentials in Windows Hardware Lab Kit allows an authorized attacker to elevate privileges locally.
Revision history
-
#1.0.0
Initiele versie