Unauthorized Access to AWS Account Findings in Microsoft Defender for Cloud

Summary

Microsoft Defender for Cloud at one point provided customers with a flawed configuration template through their public GitHub repository. This template creates resources in the customer's AWS account so that Microsoft Defender for Cloud can scan it. In the rare cases in which this template was deployed, under certain, limited circumstances, Defender for Cloud's security findings for these AWS accounts could be disclosed to unauthorized third parties.

Affected Services

Microsoft Defender for Cloud

Remediation

None required

Tracked CVEs

No tracked CVEs

References

Contributed by https://github.com/BrandonE