What is the CVSS score of CVE-2025-21385?

CVE-2025-21385 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 48.3%.

Which versions of Purview are affected by CVE-2025-21385?

CVE-2025-21385 presents significant security risk, a server-side request forgery vulnerability rated CVSS 8.8.

How to fix or mitigate CVE-2025-21385?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Implement egress filtering and URL validation for server-side requests.

Purview CVE-2025-21385

HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2025-01-09 secure@microsoft.com

Microsoft SSRF Purview

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:02 vuln.today

CVE Published

Jan 09, 2025 - 22:15 nvd

HIGH 8.8

DescriptionCVE.org

A Server-Side Request Forgery (SSRF) vulnerability in Microsoft Purview allows an authorized attacker to disclose information over a network.

AnalysisAI

Microsoft Purview contains a server-side request forgery vulnerability that allows an authorized attacker to access internal network resources and disclose sensitive information. The SSRF enables reading internal service responses, accessing cloud metadata endpoints, and potentially pivoting to internal infrastructure.

Technical ContextAI

Microsoft Purview's data scanning and classification features make HTTP requests to configured data sources. An SSRF vulnerability allows an authorized user to redirect these requests to arbitrary internal endpoints. In Azure environments, this includes the instance metadata service (IMDS) at 169.254.169.254, which returns access tokens for Azure resources.

RemediationAI

Apply the Microsoft security update. Implement SSRF protections (URL allowlisting for data sources). Restrict Purview managed identity permissions to minimum required. Monitor Azure activity logs for unusual Purview token usage.