CVE-2024-38206

—

CVSS 3.1

6.5 medium

EPSS

12%p96

Published

Aug 6, 2024 (Aug 6, 2024)

Modified

Jun 17, 2026

Description

An authenticated attacker can bypass Server-Side Request Forgery (SSRF) protection in Microsoft Copilot Studio to leak sensitive information over a network.

Vendors: microsoft
Products: copilot studio
Weakness: CWE-918
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (12.3%)

In the news4 stories

Experts disclosed a critical information-disclosure flaw in Microsoft Copilot Studio

Security AffairsAug 21, 19:36 UTC · Aug 21, 2024Vulnerability CVE-2024-38206

Microsoft Patches Critical Copilot Studio Vulnerability Exposing Sensitive Data

The Hacker NewsAug 21, 16:15 UTC · Aug 21, 2024Vulnerability CVE-2024-38206 CVE-2024-38109

Microsoft fixes 6 zero-days under active attack

Help Net SecurityAug 15, 07:12 UTC · Aug 15, 2024Exploit / PoC in the wildCVE-2024-38178 CVE-2024-38106 CVE-2024-38107+10 CVEs

Microsoft Patch Tuesday security updates for August 2024 six actively exploited bugs

Security AffairsAug 14, 07:17 UTC · Aug 14, 2024Vulnerability in the wildCVE-2024-38189 CVE-2024-38178 CVE-2024-38193+12 CVEs2