Millions of sensitive data records exposed online due to settings fault with this top Microsoft tool

Date:
Fri, 15 Nov 2024 11:29:31 +0000

Description:
A misconfiguration on permissions leaked sensitive data on millions of people.

FULL STORY ======================================================================Research ers from AppOmni found a misconfiguration bug in sites built with Microsoft Power Pages As a result, data on millions of people was leaking on the web UK NHS among affected firms, with other urged to investigate immediately

Businesses in both the private and public sector have been leaking personally identifiable information (PII) on millions of people due to a fault with a Microsoft website builder platform.

Experts from AppOmni revealed the leak stems from misconfigurations in Microsofts Power Pages, a low-code platform within the Microsoft Power Platform suite that allows users to build websites without needing to be expert coders.

However, due to misconfigured access controls - namely excessive permissions granted to the Anonymous role - many websites were leaking significant
amounts of data. That information included full names, email addresses, phone numbers, and home addresses. NHS among those affected

Power Pages is especially geared toward business users and developers who
need to build sites that integrate with business data from sources like Microsoft Dataverse, and apparently has more than 250 million monthly users.

During my research, Ive uncovered several million records of sensitive data being exposed to the public internet from authorized testing alone, the researcher said, suggesting that the leak is probably even bigger (since this was found from authorized testing alone). The primary nature of this data are internal organization files and sensitive PII belonging to both internal organization users and other users registered on the website.

Among the leaksters was the NHS - UKs National Health Service - which allegedly leaked sensitive information belonging to more than 1.1 million employees. The healthcare giant has since plugged the hole. The researchers did not want to name any other organizations leaking the data, possibly because the holes have not yet been plugged.

Misconfigured databases are one of the main causes of data leaks. Over the years, there were many instances of organizations keeping large archives of sensitive customer files without even a weak password, let alone a strong
one. You might also like Hot Topic data breach thought to have hit nearly 54 million customers Here's a list of the best firewalls around today These are the best endpoint protection tools right now



======================================================================
Link to news story: https://www.techradar.com/pro/security/millions-of-sensitive-data-records-expo sed-online-due-to-settings-fault-with-this-top-microsoft-tool


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)