Product:
Azure Cosmos DB
Summary
Improper neutralization of input during web page generation allows an unauthorized attacker to perform spoofing over a network. This vulnerability can lead to significant security risks, including unauthorized access and data manipulation. It is crucial for users to be aware of this issue to protect their systems.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.3 | CVE-2025-64675 |
Exploitation
An attacker can exploit this vulnerability by crafting a malicious input that is not properly sanitized by Azure Cosmos DB. When this input is processed, it can lead to cross-site scripting attacks, allowing the attacker to execute arbitrary scripts in the context of the victim’s session. This can result in the attacker gaining unauthorized access to sensitive information or performing actions on behalf of the user.
Affected Products
- Azure Cosmos DB: A globally distributed, multi-model database service that allows users to build applications with low latency and high availability.
Mitigation
To mitigate this vulnerability, it is recommended to implement proper input validation and sanitization techniques in web applications that interact with Azure Cosmos DB. Regularly updating the database and applying security patches can also help protect against potential exploits.