PT-2025-1038 · Microsoft · Purview

Published 2025-01-09 · Updated 2025-03-24 · CVE-2025-21385

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

A Server-Side Request Forgery (SSRF) issue exists in Microsoft Purview, allowing an authorized attacker to disclose information over a network. The affected software is Microsoft Purview, but the specific versions are not mentioned in the provided text. An exploit for this issue is available, with example code found at https://t.co/pjZlXNplRN. Further information can be found at https://t.co/zO5JzPHB8q, https://t.co/wkgoebgdM5, https://t.co/zMWGsauC2v, https://t.co/1uOrgMTikk, https://t.co/uLzNFNtlMA, and https://t.co/bfAapg51kw. #MicrosoftPurview #SSRF #ServerSideRequestForgery #Microsoft #Cybersecurity

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2025-00247

CVE-2025-21385

Affected Products

Purview

References · 16

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21385 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-00247 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-21385 · Security Note
• https://t.me/cybersecuritytechnologies/11690 · Telegram Post
• https://t.me/csirt_italia/2311 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1877679194420748601 · Twitter Post
• https://twitter.com/vuldb/status/1877601525704569058 · Twitter Post
• https://twitter.com/ksg93rd/status/1880063091045724345 · Twitter Post
• https://github.com/advisories/GHSA-q57q-p5mg-4c5w · Note
• https://t.me/cvedetector/14942 · Telegram Post
• https://twitter.com/windowsforum/status/1877503305414283618 · Twitter Post
• https://t.me/ckeArsenal/359 · Note
• https://twitter.com/ET_Labs/status/1889077176030699576 · Twitter Post
• https://twitter.com/CVEnew/status/1877620667170042330 · Twitter Post
• https://twitter.com/CveFindCom/status/1877483372303249555 · Twitter Post