CVE-2024-49071
Improper authorization of an index that contains sensitive information from a Global Files search in Windows Defender allows an authorized attacker to disclose information over a network.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
- EPSS probability
- 1.08%
- CWE
- CWE-612
- Published
- 2024-12-12
- Last modified
- 2026-06-09
Affected products
- Microsoft Microsoft Defender for Endpoint for Windows
- Microsoft Microsoft Defender for Endpoint for Windows
Weakness type
Related vulnerabilities
- CVE-2019-25605 — EquityPandit 1.0 Insecure Logging Information Disclosure
- CVE-2025-3660 — Petlibro Smart Pet Feeder Platform through 1.7.31 Broken Access Control via API endpoint
- CVE-2025-3654 — Petlibro Smart Pet Feeder Platform through 1.7.31 Information Disclosure via API endpoint
- CVE-2025-3653 — Petlibro Smart Pet Feeder through 1.7.31 Platform Improper Access Control via API endpoint
- CVE-2025-57756 — Contao discloses sensitive information in the front end search index
- CVE-2024-25635 — IDOR Vulnerability: Allowing Organization Owner to view the other Organizations API KEY and USERS
- CVE-2023-4560 — Improper Authorization of Index Containing Sensitive Information in omeka/omeka-s
- CVE-2022-41918 — Issue with fine-grained access control of indices backing data streams