CVE-2025-29814
Published: 21 March 2025
Description
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Security Summary
CVE-2025-29814 is an improper authorization vulnerability affecting Microsoft Partner Center. Published on 2025-03-21, it carries a CVSS v3.1 base score of 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H) and is associated with CWE-20 (Improper Input Validation) and NVD-CWE-noinfo.
An authorized attacker can exploit this vulnerability over a network with low complexity, requiring no privileges but some user interaction. Successful exploitation enables privilege escalation, resulting in high integrity and availability impacts across the changed scope, with no confidentiality impact.
Mitigation details are available in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29814.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The CVE describes an improper authorization vulnerability in a network-accessible application that directly enables privilege escalation with high integrity/availability impact.