CVE-2025-21177
Published: 06 February 2025
Summary
CVE-2025-21177 is a high-severity SSRF (CWE-918) vulnerability in Microsoft Dynamics 365 Sales. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 32.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Validates and sanitizes user-supplied inputs used to construct server-side requests, directly preventing SSRF exploitation in Microsoft Dynamics 365 Sales.
Boundary protection monitors and controls outbound communications, blocking unauthorized network requests forged by SSRF attacks.
Enforces information flow control policies to restrict server access to unauthorized internal resources targeted via SSRF.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SSRF in public-facing Dynamics 365 app directly matches T1190 for initial exploitation; resulting privilege elevation with high C/I impact matches T1068.
NVD Description
Server-Side Request Forgery (SSRF) in Microsoft Dynamics 365 Sales allows an authorized attacker to elevate privileges over a network.
Deeper analysisAI
CVE-2025-21177 is a Server-Side Request Forgery (SSRF) vulnerability, mapped to CWE-918, in Microsoft Dynamics 365 Sales. Published on 2025-02-06, it carries a CVSS v3.1 base score of 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), indicating high severity due to its potential for significant impact.
The vulnerability can be exploited by an authorized attacker with low privileges (PR:L) over the network (AV:N), requiring low attack complexity (AC:L) but user interaction (UI:R). Successful exploitation enables privilege elevation, achieving high confidentiality (C:H) and integrity (I:H) impacts with no availability disruption (A:N) and a changed scope (S:C).
Mitigation guidance is available in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21177.
Details
- CWE(s)