PT-2024-5743 · Microsoft · Azure Health Bot

Jimi Sebree · Published 2024-08-13 · Updated 2026-02-05 · CVE-2024-38109

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Azure Health Bot (affected versions not specified)

Description The issue is related to insufficient validation of incoming requests in Microsoft Azure Health Bot, which can be exploited by an authenticated attacker to elevate privileges over a network. This is a Server-Side Request Forgery (SSRF) vulnerability. The vulnerability is being actively exploited.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2024-06456

CVE-2024-38109

Affected Products

Azure Health Bot

References · 15

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38109 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-38109 · Security Note
• https://bdu.fstec.ru/vul/2024-06456 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-38109 · Vendor Advisory
• https://twitter.com/transilienceai/status/1826863690865348823 · Twitter Post
• https://t.me/cvenotify/91003 · Telegram Post
• https://twitter.com/transilienceai/status/1826304472974589965 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1823461840237572165 · Twitter Post
• https://twitter.com/CVEnew/status/1823414299382956053 · Twitter Post
• https://twitter.com/CveFindCom/status/1823511076043997505 · Twitter Post
• https://t.me/avleonovcom/1630 · Telegram Post
• https://twitter.com/transilienceai/status/1824564676459372620 · Twitter Post
• https://twitter.com/windowsforum/status/1831817383847018614 · Twitter Post
• https://twitter.com/fletch_ai/status/1826529986893021220 · Twitter Post
• https://t.me/cvenotify/90414 · Telegram Post