Description

Detects Azure Database for MySQL Flexible Servers configured with insecure TLS versions (below TLS 1.2). Using older TLS versions like TLS 1.0 or 1.1 exposes the database to known security vulnerabilities and may not meet compliance requirements.

Detection Strategy

• Retrieves the TLS version configuration for each Azure MySQL Flexible Server in the subscription

• Identifies the minimum TLS version allowed from the configuration value

• Reports a vulnerability if the minimum allowed TLS version is less than 1.2

• Captures the specific TLS version setting and resource ID in the vulnerability report