CVE-2025-21384

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An authenticated attacker can exploit an Server-Side Request Forgery (SSRF) vulnerability in Microsoft Azure Health Bot to elevate privileges over a network.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-693 CWE-918

Affected software

Vendor	Product	Versions
Microsoft	Azure Health Bot	-

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21384Vendor Advisory

Timeline

Published: Apr 1, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-213856.5A Server-Side Request Forgery (SSRF) vulnerability in Microsoft Purview allows an authorized attacker to disclose information over a network CVE-2025-213867.8Microsoft Excel Remote Code Execution Vulnerability CVE-2025-213877.8Microsoft Excel Remote Code Execution Vulnerability CVE-2025-213897.5Uncontrolled resource consumption in Windows Universal Plug and Play (UPnP) Device Host allows an unauthorized attacker to deny service over CVE-2025-21393.5IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to delete reviews CVE-2025-213907.8Microsoft Excel Remote Code Execution Vulnerability CVE-2025-213917.1Windows Storage Elevation of Privilege Vulnerability CVE-2025-213927.8Microsoft Office Remote Code Execution Vulnerability CVE-2025-213936.3Microsoft SharePoint Server Spoofing Vulnerability CVE-2025-213947.8Microsoft Excel Remote Code Execution Vulnerability CVE-2025-213957.8Microsoft Access Remote Code Execution Vulnerability CVE-2025-213968.2Missing authorization in Microsoft Account allows an unauthorized attacker to elevate privileges over a network.