Power Platform Custom Code information disclosure

A vulnerability in Power Platform could lead to unauthorized access to Custom
Code functions used for custom connectors, thereby allowing cross-tenant information
disclosure of secrets or other sensitive information if these were embedded in a
Custom Code function. The issue occurred as a result of insufficient access control
to Azure Function hosts, which are launched as part of the creation and operation of
custom connectors in Microsoft’s Power Platform. An attacker who determined the
hostname of the Azure Function associated …

access access control azure code connectors control disclosure embedded function functions information information disclosure issue platform power result secrets sensitive information unauthorized access vulnerability