What is the severity of CVE-2025-21385?

CVE-2025-21385 is categorized as a critical severity vulnerability due to its potential to allow unauthorized information disclosure.

How do I fix CVE-2025-21385?

To mitigate CVE-2025-21385, ensure that you apply the latest security updates provided by Microsoft for Purview.

Who is affected by CVE-2025-21385?

Authorized users of Microsoft Purview may be vulnerable to CVE-2025-21385.

What type of vulnerability is CVE-2025-21385?

CVE-2025-21385 is a Server-Side Request Forgery (SSRF) vulnerability.

What can an attacker do with CVE-2025-21385?

An attacker exploiting CVE-2025-21385 can disclose sensitive information over a network.

Vulnerability/
CVE-2025-21385

high

8.8

CWE

918

EPSS

0.050%

9/1/2025

21/2/2025

CVE-2025-21385: Microsoft Purview Information Disclosure Vulnerability

First published: Thu Jan 09 2025(Updated: )

<p>A Server-Side Request Forgery (SSRF) vulnerability in Microsoft Purview allows an authorized attacker to disclose information over a network.</p>

Credit: secure@microsoft.com

Affected Software	Affected Version	How to fix
Microsoft Purview
Microsoft Purview

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2025-21385?
CVE-2025-21385 is categorized as a critical severity vulnerability due to its potential to allow unauthorized information disclosure.
How do I fix CVE-2025-21385?
To mitigate CVE-2025-21385, ensure that you apply the latest security updates provided by Microsoft for Purview.
Who is affected by CVE-2025-21385?
Authorized users of Microsoft Purview may be vulnerable to CVE-2025-21385.
What type of vulnerability is CVE-2025-21385?
CVE-2025-21385 is a Server-Side Request Forgery (SSRF) vulnerability.
What can an attacker do with CVE-2025-21385?
An attacker exploiting CVE-2025-21385 can disclose sensitive information over a network.

collector/msrc
source/Microsoft
agent/weakness
agent/first-publish-date
agent/type
agent/software-canonical-lookup
agent/software-canonical-lookup-request
collector/msrc-cve
agent/softwarecombine
agent/title
collector/nvd-api
source/NVD
agent/severity
agent/description
agent/author
collector/the-register
source/The Register
alias/CVE-2025-21333
alias/CVE-2025-21334
alias/CVE-2025-21335
alias/CVE-2025-21311
alias/CVE-2025-21298
alias/CVE-2025-21307
alias/CVE-2025-21362
alias/CVE-2025-21354
alias/CVE-2025-21309
alias/CVE-2025-21297
alias/CVE-2025-21380
alias/CVE-2025-21385
alias/CVE-2025-21178
agent/references
agent/event
agent/trending
agent/tags
collector/epss-latest
source/FIRST
agent/epss
collector/mitre-cve
source/MITRE
agent/last-modified-date
agent/source
vendor/microsoft
canonical/microsoft purview

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.

Frequently Asked Questions

What is the severity of CVE-2025-21385?
CVE-2025-21385 is categorized as a critical severity vulnerability due to its potential to allow unauthorized information disclosure.
How do I fix CVE-2025-21385?
To mitigate CVE-2025-21385, ensure that you apply the latest security updates provided by Microsoft for Purview.
Who is affected by CVE-2025-21385?
Authorized users of Microsoft Purview may be vulnerable to CVE-2025-21385.
What type of vulnerability is CVE-2025-21385?
CVE-2025-21385 is a Server-Side Request Forgery (SSRF) vulnerability.
What can an attacker do with CVE-2025-21385?
An attacker exploiting CVE-2025-21385 can disclose sensitive information over a network.