This vulnerability (CVE-2025-64675) in Azure Cosmos DB is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e., Cross-site Scripting). It allows an attacker to inject malicious scripts into web pages generated by the service, potentially enabling spoofing attacks that compromise user trust and data confidentiality. The CVSS 3.1 vector indicates network attack vector, low complexity, no privileges required, user interaction needed, unchanged scope, high confidentiality and integrity impact, and low availability impact. Microsoft has published this vulnerability and a patch is available.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, leading to spoofing attacks and potential compromise of sensitive information. The impact affects confidentiality and integrity at a high level, with limited impact on availability. No known exploits are reported in the wild at this time.

A patch is available for this vulnerability. It is recommended to apply the official fix provided by Microsoft to remediate the issue. Since this is not a cloud-hosted service vulnerability, users must update their Azure Cosmos DB installations accordingly. Monitor the vendor advisory for patch details and deployment instructions.