CVE-2025-21415

Published Jan 29, 2025

Last updated 6 days ago

Overview

AI description

Generated using AI and has not been reviewed by Intruder. May contain errors.

CVE-2025-21415 is an authentication bypass vulnerability due to spoofing, affecting Microsoft's Azure AI Face Service. An attacker who already has authorization could exploit this flaw to gain elevated privileges on the network. Microsoft has acknowledged the existence of proof-of-concept exploit code for this vulnerability. While the specific details of the vulnerability have not been publicly disclosed, it involves a discrepancy in how the Azure AI Face service analyzes and processes images. Microsoft has addressed the vulnerability without requiring any action from customers. The fix was deployed, and the vulnerability mitigated by February 4, 2025.

Description: Authentication bypass by spoofing in Azure AI Face Service allows an authorized attacker to elevate privileges over a network.
Source: secure@microsoft.com
NVD status: Received
CNA Tags: exclusively-hosted-service

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.9
Impact score: 6
Exploitability score: 3.1
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

secure@microsoft.com: CWE-290

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 6

Overview

AI description

Risk scores

CVSS 3.1

Weaknesses

Social media

References