CVE-2025-21385
Published: 09 January 2025
Summary
CVE-2025-21385 is a high-severity SSRF (CWE-918) vulnerability in Microsoft Purview. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 2.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the SSRF vulnerability by requiring timely patching and flaw remediation as specified in the Microsoft advisory.
Prevents SSRF exploitation by validating inputs that could be used to forge unauthorized server-side network requests.
Enforces boundary protections to restrict outbound connections, blocking unauthorized network requests triggered by SSRF.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SSRF in a network-accessible Microsoft Purview service directly enables remote exploitation of a public-facing application to force unauthorized server-side requests and information disclosure.
NVD Description
A Server-Side Request Forgery (SSRF) vulnerability in Microsoft Purview allows an authorized attacker to disclose information over a network.
Deeper analysisAI
CVE-2025-21385 is a Server-Side Request Forgery (SSRF) vulnerability, classified under CWE-918, affecting Microsoft Purview. Published on January 9, 2025, it enables an authorized attacker to disclose information over a network. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact on confidentiality, integrity, and availability.
An authorized attacker with low privileges can exploit this SSRF remotely over the network with low attack complexity and no user interaction required. Successful exploitation allows the attacker to force the server to make unauthorized requests, leading to sensitive information disclosure across the network, as well as potential integrity and availability disruptions aligned with the high CVSS impact metrics.
For mitigation details, refer to the official Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21385, which provides guidance on patches and workarounds.
Details
- CWE(s)