Azure Storage Resource Provider
CVE-2025-29972 — Azure Storage Resource Provider Spoofing Vulnerability
Executive Summary
Server-Side Request Forgery (SSRF) in Azure allows an authorized attacker to perform spoofing over a network.
Overview
9.8
CVSS CRITICAL
Critical
MS Severity
Not Exploited
MS Exploit Status
N/A
MS Exploit Likelihood
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
ATTACK VECTOR
Network
ATTACK COMPLEXITY
Low
PRIVILEGES REQUIRED
None
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
High
AVAILABILITY
High
EXPLOIT CODE MATURITY
Proof-of-Concept
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 8.9
EPSS Score
0.0316
probability of exploitation in the next 30 days
0.86843 percentile - updated 2026-08-14
View on FIRST.org
Exploits & PoC
2 public PoCsUnverified third-party code
Public proof-of-concept repositories aggregated from PoC-in-GitHub. They are not reviewed and may be incomplete, non-functional, or malicious — inspect the code before running anything.
| Repository | Stars | Published | Description |
|---|---|---|---|
| ThemeHackers/CVE-2025-29972 | 2 | 2025-03-25 | CVE-2025-29927 is a critical security vulnerability affecting Next.js, a popular React framework for building full-stack web applications. This flaw allows attackers to bypass authorization checks imp |
| TH-SecForge/CVE-2025-29972 | 1 | 2025-06-09 | CVE-2025-29927 - Critical Security Vulnerability in Next.js |
Detection Rules
No public Sigma or Nuclei detection rule has been mapped to this CVE yet. Coverage is concentrated on exploited / high-profile vulnerabilities; check SigmaHQ for updates.
Acknowledgments
G1ND1L4
Stav Nir with Microsoft
References
On This Page