Cyber Posture

CVE-2025-29807

High

Published: 21 March 2025

Published
21 March 2025
Modified
03 July 2025
KEV Added
Patch
CVSS Score 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
EPSS Score 0.0105 77.6th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

Security Summary

CVE-2025-29807 is a deserialization of untrusted data vulnerability affecting Microsoft Dataverse. Published on 2025-03-21, it is associated with CWE-94 (code injection) and CWE-502 (deserialization of untrusted data), earning a CVSS v3.1 base score of 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).

An authorized attacker with low privileges (PR:L) can exploit this vulnerability over the network (AV:N) with low attack complexity (AC:L), though it requires user interaction (UI:R). Successful exploitation allows remote code execution, resulting in high impacts to confidentiality and integrity (C:H/I:H), with no impact to availability (A:N) but a changed scope (S:C).

The Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29807 provides details on mitigation and patches.

Details

CWE(s)
CWE-94CWE-502

Affected Products

microsoft
dataverse
all versions

MITRE ATT&CK Enterprise Techniques

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

The deserialization vulnerability in Microsoft Dataverse allows a low-privileged authenticated attacker to achieve remote code execution (CWE-94/502), directly mapping to exploitation for privilege escalation from low to high impact.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References