CVE-2025-21380
Published: 09 January 2025
Summary
CVE-2025-21380 is a high-severity Improper Access Control (CWE-284) vulnerability in Microsoft Azure Marketplace. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 12.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly enforces approved authorizations to mitigate improper access control allowing low-privilege attackers to disclose sensitive information in Azure SaaS Resources.
Applies least privilege to restrict low-privilege (PR:L) users from accessing or disclosing unauthorized information over the network.
Remediates the specific improper access control flaw via timely patching as detailed in the Microsoft advisory, preventing exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Improper access control in Azure SaaS enables remote exploitation from low-priv accounts (T1190) to achieve privilege escalation effects (T1068) and unauthorized data access (T1530).
NVD Description
Improper access control in Azure SaaS Resources allows an authorized attacker to disclose information over a network.
Deeper analysisAI
CVE-2025-21380 is an improper access control vulnerability affecting Azure SaaS Resources. Published on January 9, 2025, it allows an authorized attacker to disclose information over a network. The vulnerability is associated with CWE-284 (Improper Access Control) and NVD-CWE-Other, earning a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to network accessibility, low attack complexity, and significant impacts on confidentiality, integrity, and availability.
An authorized attacker with low privileges (PR:L) can exploit this vulnerability remotely over the network without user interaction. Successful exploitation enables high-level disclosure of sensitive information, alongside potential high impacts to integrity and availability, such as unauthorized modifications or disruptions within the affected Azure SaaS Resources.
For mitigation details, including available patches and remediation steps, security practitioners should refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21380.
Details
- CWE(s)