Microsoft Copilot Studio SSRF Information Disclosure (CVE-2024-38206)
Date: 2024-08
Affected: Microsoft Copilot Studio
Attack vector: data-exfiltration
Category: research
Severity: High

Critical SSRF protection bypass in Microsoft Copilot Studio (CVSS 8.5) allowed authenticated attackers to leak sensitive information over the network. Mitigated August 2024.


Mitigations:

Architectural layers (MAESTRO):