Summary
Microsoft heeft kwetsbaarheden verholpen in Azure-producten.
Details
Interpretaties
De kwetsbaarheden zijn gerelateerd aan onjuiste toegangscontrolemechanismen, waardoor geautoriseerde aanvallers lokale spoofing-aanvallen kunnen uitvoeren, verhoogde privileges kunnen verkrijgen, gevoelige informatie kunnen onthullen en de integriteit van systemen kunnen compromitteren. Dit kan leiden tot ongeautoriseerde toegang en manipulatie van gevoelige gegevens.
```
Azure Stack:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-53765 | 4.40 | Toegang tot gevoelige gegevens |
| CVE-2025-53793 | 7.50 | Toegang tot gevoelige gegevens |
|----------------|------|-------------------------------------|
Azure OpenAI:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-53767 | 10.00 | Verkrijgen van verhoogde rechten |
|----------------|------|-------------------------------------|
Azure Portal:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-53792 | 9.10 | Verkrijgen van verhoogde rechten |
|----------------|------|-------------------------------------|
Azure Virtual Machines:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-53781 | 7.70 | Toegang tot gevoelige gegevens |
| CVE-2025-49707 | 7.90 | Voordoen als andere gebruiker |
|----------------|------|-------------------------------------|
Azure File Sync:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-53729 | 7.80 | Verkrijgen van verhoogde rechten |
|----------------|------|-------------------------------------|
```
Oplossingen
Microsoft heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Vulnerabilities 7
-
Critical 10.0
Azure OpenAI Elevation of Privilege Vulnerability
Azure OpenAI Elevation of Privilege Vulnerability
-
Critical 9.1
Azure Portal Elevation of Privilege Vulnerability
Azure Portal Elevation of Privilege Vulnerability
-
High 7.9
Azure Virtual Machines Spoofing Vulnerability
Improper access control in Azure Virtual Machines allows an authorized attacker to perform spoofing locally.
-
High 7.8
Microsoft Azure File Sync Elevation of Privilege Vulnerability
Improper access control in Azure File Sync allows an authorized attacker to elevate privileges locally.
-
High 7.7
Azure Virtual Machines Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Azure Virtual Machines allows an authorized attacker to disclose information over a network.
-
High 7.5
Azure Stack Hub Information Disclosure Vulnerability
Improper authentication in Azure Stack allows an unauthorized attacker to disclose information over a network.
-
Medium 4.4
Azure Stack Hub Information Disclosure Vulnerability
Exposure of private personal information to an unauthorized actor in Azure Stack allows an authorized attacker to disclose information locally.
Revision history
-
#1.0.0
Initiele versie
References
-
Reference
https://portal.msrc.microsoft.com/en-us/security-guidance