CVE-2025-21177
Published: 06 February 2025
Description
Server-Side Request Forgery (SSRF) in Microsoft Dynamics 365 Sales allows an authorized attacker to elevate privileges over a network.
Security Summary
CVE-2025-21177 is a Server-Side Request Forgery (SSRF) vulnerability, mapped to CWE-918, in Microsoft Dynamics 365 Sales. Published on 2025-02-06, it carries a CVSS v3.1 base score of 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), indicating high severity due to its potential for significant impact.
The vulnerability can be exploited by an authorized attacker with low privileges (PR:L) over the network (AV:N), requiring low attack complexity (AC:L) but user interaction (UI:R). Successful exploitation enables privilege elevation, achieving high confidentiality (C:H) and integrity (I:H) impacts with no availability disruption (A:N) and a changed scope (S:C).
Mitigation guidance is available in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21177.
Details
- CWE(s)