CVE-2024-38206

CVSS 3.1: 6.5 medium
EPSS: 12%p96
Published: Aug 6, 2024 · Aug 6, 2024
Modified: Jun 17, 2026

Analyze CVE-2024-38206 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

An authenticated attacker can bypass Server-Side Request Forgery (SSRF) protection in Microsoft Copilot Studio to leak sensitive information over a network.

Vendors: microsoft

Products: copilot studio

Weakness: CWE-918

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (12.3%)

In the news

4 stories

Experts disclosed a critical information-disclosure flaw in Microsoft Copilot Studio

Security AffairsAug 21, 19:36 UTC · Aug 21, 2024VulnerabilityCVE-2024-382062 · 1 read

Microsoft Patches Critical Copilot Studio Vulnerability Exposing Sensitive Data

The Hacker NewsAug 21, 16:15 UTC · Aug 21, 2024VulnerabilityCVE-2024-38206 CVE-2024-381093 · 1 read

Microsoft fixes 6 zero-days under active attack

Help Net SecurityAug 15, 07:12 UTC · Aug 15, 2024Exploit / PoCExploitedCVE-2024-38178 CVE-2024-38106 CVE-2024-38107+101 · 1 read

Microsoft Patch Tuesday security updates for August 2024 six actively exploited bugs

Security AffairsAug 14, 07:17 UTC · Aug 14, 2024VulnerabilityExploitedCVE-2024-38189 CVE-2024-38178 CVE-2024-38193+124 · 1 read