Product:
Custom Question Answering
Summary
This vulnerability allows for elevation of privilege in the Custom Question Answering product. It can lead to unauthorized access and manipulation of sensitive data. The issue arises from improper handling of user inputs, which can be exploited by attackers.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.9 | CVE-2025-64663 |
Exploitation
To exploit this vulnerability, an attacker can send specially crafted requests over the network to the affected product. Due to the low attack complexity and lack of user interaction required, this makes it easier for attackers to gain elevated privileges. Once exploited, the attacker can manipulate data and potentially compromise the system.
Affected Products
- Custom Question Answering: Affected by the elevation of privilege vulnerability, allowing unauthorized access to sensitive data.
Mitigation
To mitigate this vulnerability, users should apply the latest security updates provided by Microsoft. Additionally, implementing strict access controls and monitoring network traffic can help reduce the risk of exploitation.