CVE-2025-70027

High

Published: 11 March 2026

Published

11 March 2026

Modified

02 April 2026

KEV Added

—

Patch

—

CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score 0.0004 13.5th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-70027 is a high-severity SSRF (CWE-918) vulnerability in Sunbird Sunbirded-Portal. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 13.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190).

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CA-8 Penetration Testing

addresses: CWE-918

Penetration testing attempts server-side requests to internal resources, identifying SSRF weaknesses for remediation.

SC-7 Boundary Protection

addresses: CWE-918

Outbound connections to external resources can be monitored and limited at the boundary, reducing SSRF impact.

SI-10 Information Input Validation

addresses: CWE-918

Validates server-side URLs and resource references to block SSRF attempts.

SI-4 System Monitoring

addresses: CWE-918

Detects server-side request forgery through monitoring of unexpected outbound connections.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

SSRF in public-facing portal directly enables remote exploitation of the application to reach internal resources.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

An issue pertaining to CWE-918: Server-Side Request Forgery was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4. This allows attackers to obtain sensitive information

Deeper analysisAI

CVE-2025-70027 is a Server-Side Request Forgery (SSRF) vulnerability, corresponding to CWE-918, discovered in Sunbird-Ed SunbirdEd-portal version 1.13.4. Published on 2026-03-11T15:16:21.507, it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with no effects on integrity or availability.

Remote, unauthenticated attackers can exploit this vulnerability over the network with low attack complexity and no user interaction required. Exploitation allows attackers to obtain sensitive information hosted on internal systems or otherwise inaccessible resources via forged requests from the vulnerable server.

Mitigation details and further technical information are available in the referenced advisories, including https://gist.github.com/zcxlighthouse/6eac455e9094ae313a1c39c25d520b3d, https://github.com/Sunbird-Ed, and https://github.com/Sunbird-Ed/SunbirdEd-portal.