Remote Code Execution Vulnerability In Apache Hugegraph Server Cve 2024 27348

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical CosmosEscape Vulnerability Exposes Azure Cosmos DB to Potential Attacks Wiz Research disclosed a critical vulnerability named CosmosEscape in Azure Cosmos DB, allowing attackers to potentially compromise every database in the service, including Microsoft's internal systems like Entra ID, Teams, and Copilot. The flaw, residing in the Gremlin API, could have enabled attackers to acquire the Cosmos Master Key, granting full read and write access to databases. This vulnerability posed a significant risk of cross-tenant attacks, potentially impacting millions of workloads. Microsoft has since remediated the issue by eliminating the Cosmos Master Key and has confirmed no evidence of exploitation. Security experts emphasize the importance of reviewing security postures despite the patch, as traditional tools may not detect such vulnerabilities. The incident serves as a reminder of the inherent risks in shared cloud infrastructure. 6 sources 71