CVE-2023-32024
Published: 14 June 2023
Summary
CVE-2023-32024 is a low-severity Cross-site Scripting (CWE-79) vulnerability in Microsoft Power Apps. Its CVSS base score is 3.0 (Low).
Operationally, ranked in the top 46.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2023-32024 is a spoofing vulnerability in Microsoft Power Apps that carries a CVSS 3.0 base score of 3.0 and is linked to CWE-79. The flaw permits an attacker to present falsified content or capture limited information through a network vector that requires high attack complexity, low privileges, and user interaction, resulting in changed scope but only limited confidentiality impact.
An authenticated user with low privileges can trigger the issue by supplying crafted input that a victim must interact with, allowing the attacker to spoof interface elements or obtain restricted data within the affected Power Apps environment.
Microsoft has published remediation guidance in its Security Response Center update guide for CVE-2023-32024, directing administrators to apply the recommended updates or configuration changes listed in the advisory.
The EPSS probability rose from a low baseline to a peak of 0.0762 on 2025-01-22 before receding, indicating that exploitation interest emerged after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-36311
Vulnerability details
Microsoft Power Apps Spoofing Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.