CVE-2025-24053
Published: 13 March 2025
Summary
CVE-2025-24053 is a high-severity Improper Authorization (CWE-285) vulnerability in Microsoft Dataverse. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 30.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-2 (Account Management) and AC-6 (Least Privilege).
Deeper analysis
CVE-2025-24053 is an improper authentication vulnerability (CWE-285) affecting Microsoft Dataverse. Published on 2025-03-13, it enables an authorized attacker to elevate privileges over a network. The issue carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its network accessibility, low complexity, and significant impacts across confidentiality, integrity, and availability.
The vulnerability requires high privileges (PR:H) for exploitation, meaning attackers must already possess an authorized account with elevated access within the affected environment. Exploitation occurs over the network without user interaction, allowing the attacker to escalate privileges further, potentially compromising the full triad of security impacts at a high level.
Microsoft's advisory provides details on mitigation; practitioners should consult the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24053 for patching instructions and workarounds.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6308
Vulnerability details
Improper authentication in Microsoft Dataverse allows an authorized attacker to elevate privileges over a network.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes an improper authentication flaw in Microsoft Dataverse that allows an already-authorized (high-privilege) attacker to escalate privileges over the network, directly enabling the Exploitation for Privilege Escalation technique.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates CVE-2025-24053 by requiring timely flaw remediation, including patching and workarounds specified in Microsoft's advisory for the improper authentication vulnerability.
Counters privilege escalation from the improper authentication by enforcing least privilege, limiting impact even for PR:H attackers.
Reduces exploitation risk by managing accounts to minimize high-privilege (PR:H) access necessary for triggering the vulnerability.