Cyber Resilience

CVE-2024-29063

High

Published: 09 April 2024

Published
09 April 2024
Modified
09 January 2025
KEV Added
Patch
CVSS Score v3.1 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
EPSS Score 0.0122 79.4th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-29063 is a high-severity Use of Hard-coded Credentials (CWE-798) vulnerability in Microsoft Azure Ai Search. Its CVSS base score is 7.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Information Repositories (T1213); ranked in the top 20.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

This vulnerability is AI-related — categorised as Other Platforms; in the Privacy and Disclosure risk domain; MITRE ATLAS techniques in scope: Active Scanning (AML.T0006), Obtain Capabilities (AML.T0016), AI Artifact Collection (AML.T0035).

EU & UK References

Vulnerability details

Azure AI Search Information Disclosure Vulnerability

CWE(s)

AI Security AnalysisAI

AI Category
Other Platforms
Risk Domain
Privacy and Disclosure
OWASP Top 10 for LLMs 2025
None mapped
Classification Reason
Azure AI Search is a cloud-based AI-powered search platform providing semantic, vector, and hybrid search capabilities for AI applications like RAG, fitting under Other Platforms as an enterprise AI service.

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1213 Data from Information Repositories Collection
Adversaries may leverage information repositories to mine valuable information.
Why these techniques?

The information disclosure vulnerability in Azure AI Search enables adversaries to collect data from an information repository.

MITRE ATLAS TechniquesAI

MITRE ATLAS techniques

AML.T0006: Active ScanningAML.T0016: Obtain CapabilitiesAML.T0035: AI Artifact CollectionAML.T0036: Data from Information Repositories

Affected Assets

microsoft
azure ai search
all versions

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-798

Enables users to notice when hard-coded credentials have been exploited for unauthorized access.

addresses: CWE-798

Security training explicitly warns against hard-coded credentials, lowering their use in systems.

addresses: CWE-798

Policy and procedures prohibit hard-coded credentials in favor of managed authentication.

addresses: CWE-798

External identity providers eliminate the need for hard-coded credentials in applications.

addresses: CWE-798

Changing default authenticators prior to first use and protecting content prevents use of hard-coded credentials.

addresses: CWE-798

Central credential stores and rotation policies remove the need for hard-coded credentials in configuration files or code.

addresses: CWE-798

Intelligence programs surface reports of campaigns that abuse hard-coded credentials in products, prompting removal or replacement and thereby reducing successful exploitation.

addresses: CWE-798

Planned investment enables secure credential storage and management systems instead of hard-coded credentials.

References