PT-2024-8874 · Unknown · Copilot Studio

Published 2024-11-26 · Updated 2025-11-26 · CVE-2024-49038

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Copilot Studio (affected versions not specified)

Description: The issue is related to the improper neutralization of input during web page generation, also known as 'Cross-site Scripting', in Copilot Studio. This can allow an unauthorized attacker to elevate their privileges over a network. The vulnerability is associated with the failure to protect the structure of web pages.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-10541

CVE-2024-49038

Affected Products

Copilot Studio

References · 8

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49038 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-10541 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-49038 · Security Note
• https://twitter.com/CVEnew/status/1861504240830804400 · Twitter Post
• https://twitter.com/secdim/status/1993538681060393036 · Twitter Post
• https://twitter.com/Eth1calHackrZ/status/1864822064793948448 · Twitter Post
• https://twitter.com/cyraxsecurity/status/1862727190996992482 · Twitter Post
• https://twitter.com/CveFindCom/status/1861501589359411482 · Twitter Post