CVE-2025-24989

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-24989
An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control. This vulnerability has already been mitigated in the service and all affected customers have been notified. This update addressed the registration control bypass. Affected customers have been given instructions on reviewing their sites for potential exploitation and clean up methods. If you've not been notified this vulnerability does not affect you.

8.2 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24989 Patch Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:microsoft:power_pages:-:*:*:*:*:*:*:*
History

24 Feb 2025, 14:55

Type Values Removed Values Added
CWE NVD-CWE-noinfo
First Time Microsoft
Microsoft power Pages
CPE cpe:2.3:a:microsoft:power_pages:-:*:*:*:*:*:*:*
References () https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24989 - () https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24989 - Patch, Vendor Advisory

21 Feb 2025, 18:15

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad de control de acceso inadecuado en Power Pages permite a un atacante no autorizado elevar privilegios en una red y posiblemente eludir el control de registro de usuarios. Esta vulnerabilidad ya se ha mitigado en el servicio y se ha notificado a todos los clientes afectados. Esta actualización solucionó el problema de eludir el control de registro. Se han dado instrucciones a los clientes afectados para que revisen sus sitios en busca de posibles explotaciones y métodos de depuración. Si no ha recibido una notificación, esta vulnerabilidad no le afecta.
Summary (en) An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control. This vulnerability has already been mitigated in the service and all affected cusomters have been notified. This update addressed the registration control bypass. Affected customers have been given instructions on reviewing their sites for potential exploitation and clean up methods. If you've not been notified this vulnerability does not affect you. (en) An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control. This vulnerability has already been mitigated in the service and all affected customers have been notified. This update addressed the registration control bypass. Affected customers have been given instructions on reviewing their sites for potential exploitation and clean up methods. If you've not been notified this vulnerability does not affect you.

19 Feb 2025, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-19 23:15

Updated : 2025-02-24 14:55

NVD link : CVE-2025-24989

Mitre link : CVE-2025-24989

CVE.ORG link : CVE-2025-24989

JSON object : View

Products Affected

microsoft

  • power_pages
CWE
CWE-284

Improper Access Control

NVD-CWE-noinfo