CVE-2025-21385
Published: 09 January 2025
Summary
CVE-2025-21385 is a high-severity SSRF (CWE-918) vulnerability in Microsoft Purview. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 2.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-10 (Information Input Validation).
Deeper analysis
A Server-Side Request Forgery vulnerability tracked as CVE-2025-21385 affects Microsoft Purview. The flaw, assigned CWE-918, received a CVSS 3.1 base score of 8.8 and permits an authorized attacker to disclose information over a network.
An attacker with low-privileged network access and no user interaction required can exploit the issue to achieve high impact on confidentiality, integrity, and availability. The published EPSS score stands at 0.5278 with an identical peak value, indicating steady rather than rising exploitation probability since disclosure.
The Microsoft Security Response Center advisory published at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21385 provides official guidance on the vulnerability.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2447
Vulnerability details
A Server-Side Request Forgery (SSRF) vulnerability in Microsoft Purview allows an authorized attacker to disclose information over a network.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SSRF in a network-accessible Microsoft Purview service directly enables remote exploitation of a public-facing application to force unauthorized server-side requests and information disclosure.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the SSRF vulnerability by requiring timely patching and flaw remediation as specified in the Microsoft advisory.
Prevents SSRF exploitation by validating inputs that could be used to forge unauthorized server-side network requests.
Enforces boundary protections to restrict outbound connections, blocking unauthorized network requests triggered by SSRF.