Payroll Processing Platform

Security Authorisation Assessment

SA
Finding · VUL-014

High-severity vulnerability in Azure API Management

An unresolved high-severity vulnerability affecting an internet-adjacent API component of the payroll platform.

HIGHOpen
Severity
High
Affected Asset
Azure API Management
Source
Defender for Cloud
CVSS
8.1
Status
Open
Detected
2 days ago
Finding DetailReasoned into residual risk
Preview

The API Management instance is running a version with a known high-severity vulnerability. Combined with the recent exposure change (CHG-021), VERIDION elevates the associated internet-facing risk pending remediation.

Contributing Factors
Preview

Signals that shaped this finding.

  • Component version behind current patch baseline
  • Endpoint recently changed to internet accessible (CHG-021)
  • No compensating WAF rule evidenced for the affected path
Treatment Options
Preview

Prepared for the system owner’s decision.

OptionEffectEffort
Patch to current versionRemoves vulnerabilityMedium
Restore private accessReduces exposureLow
Add WAF ruleCompensating controlLow
Demo workspace — detailed workflow coming next