CVE-2025-21384

Published: Apr 1, 2025Modified: Jul 8, 2025

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

An authenticated attacker can exploit an Server-Side Request Forgery (SSRF) vulnerability in Microsoft Azure Health Bot to elevate privileges over a network.

Affected (1)

Products: Microsoft: Azure Health Bot

Microsoft

1 product

Azure Health Bot

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Microsoft Azure Health Bot	All versions

Related CWEs

CWE-693

Protection Mechanism Failure

The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

CWE-918

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (1)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21384

Source: secure@microsoft.com

Vendor Advisory

Timeline

No history available yet.