Information Disclosure Vulnerability
CVE-2024-21380

8HIGH

Key Information:

Vendor

Microsoft
Status
Microsoft Dynamics 365 Business Central 2022 Release Wave 2
Microsoft Dynamics 365 Business Central 2023 Release Wave 1
Microsoft Dynamics 365 Business Central 2023 Release Wave 2
Vendor
CVE Published:
13 February 2024

What is CVE-2024-21380?

An information disclosure vulnerability exists in Microsoft Dynamics Business Central and NAV, which can potentially expose sensitive data to unauthorized users. This vulnerability stems from improper handling of user requests, allowing an attacker to gain access to confidential information. Organizations utilizing these platforms should take immediate action to assess their system configurations and apply relevant security updates to mitigate the risks associated with this vulnerability.

Affected Version(s)

Microsoft Dynamics 365 Business Central 2022 Release Wave 2 21.0.0 < 21.0.63175

Microsoft Dynamics 365 Business Central 2023 Release Wave 1 22.0.0 < 22.0.63124

Microsoft Dynamics 365 Business Central 2023 Release Wave 2 23.0.0 < 23.0.15712

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.