Cyber Posture

CVE-2025-21343

High

Published: 14 January 2025

Published
14 January 2025
Modified
21 January 2025
KEV Added
—
Patch
—
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0539 90.2th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Windows Web Threat Defense User Service Information Disclosure Vulnerability

Security Summary

CVE-2025-21343 is an information disclosure vulnerability in the Windows Web Threat Defense User Service. Published on 2025-01-14, it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and is associated with CWE-269 (Improper Privilege Management) and NVD-CWE-noinfo.

The vulnerability allows a remote unauthenticated attacker to exploit the service over the network with low attack complexity and no user interaction required. Successful exploitation results in high-impact disclosure of sensitive information, with no impact on integrity or availability.

Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21343 provides details on mitigation and available patches.

Details

CWE(s)
CWE-269NVD-CWE-noinfo

Affected Products

microsoft
windows 11 22h2
≤ 10.0.22621.4751
microsoft
windows 11 23h2
≤ 10.0.22631.4751
microsoft
windows 11 24h2
≤ 10.0.26100.2894

References