Improper Authorization in Microsoft products - CVE-2025-21348
Published: January 14, 2025
Vulnerability identifier: #VU102664
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-21348
CWE-ID: CWE-285
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to bypass authorization checks.
The vulnerability exists due to insufficient authorization controls in Microsoft SharePoint Server. A remote administrator can execute arbitrary code on the target system.
Affected software
Microsoft SharePoint Server Subscription Edition
Microsoft SharePoint Enterprise Server
Microsoft SharePoint Server
Microsoft SharePoint Enterprise Server
Microsoft SharePoint Server
How to mitigate CVE-2025-21348
Install updates from vendor's website.