CVE-2025-21348
Published: 14 January 2025
Summary
CVE-2025-21348 is a high-severity Improper Authorization (CWE-285) vulnerability in Microsoft Sharepoint Server. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 25.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the RCE vulnerability by requiring timely identification, reporting, and correction of flaws like CVE-2025-21348 through vendor patches.
Enforces approved authorizations for access to SharePoint resources, directly addressing the improper authorization (CWE-285) that enables high-privilege RCE exploitation.
Limits damage from PR:H exploitation by ensuring users and processes operate with least privilege necessary, reducing the attack surface in SharePoint.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote code execution vulnerability in public-facing Microsoft SharePoint Server directly maps to exploitation of public-facing applications for code execution.
NVD Description
Microsoft SharePoint Server Remote Code Execution Vulnerability
Deeper analysisAI
CVE-2025-21348 is a Remote Code Execution vulnerability in Microsoft SharePoint Server. Published on 2025-01-14, it has a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-285 (Improper Authorization) and NVD-CWE-noinfo.
An attacker with high privileges required (PR:H) can exploit this vulnerability over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Successful exploitation allows remote code execution with high impact on confidentiality, integrity, and availability (C:H/I:H/A:H) within the unchanged scope (S:U).
Microsoft's Security Response Center provides mitigation guidance in their update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21348.
Details
- CWE(s)