Information Disclosure Vulnerability
CVE-2024-21380

8HIGH

Key Information:

Vendor
Microsoft
Status
Microsoft Dynamics 365 Business Central 2022 Release Wave 2
Microsoft Dynamics 365 Business Central 2023 Release Wave 1
Microsoft Dynamics 365 Business Central 2023 Release Wave 2
Vendor
CVE Published:
13 February 2024

Summary

An information disclosure vulnerability exists in Microsoft Dynamics Business Central and NAV, which can potentially expose sensitive data to unauthorized users. This vulnerability stems from improper handling of user requests, allowing an attacker to gain access to confidential information. Organizations utilizing these platforms should take immediate action to assess their system configurations and apply relevant security updates to mitigate the risks associated with this vulnerability.

Affected Version(s)

Microsoft Dynamics 365 Business Central 2022 Release Wave 2 Unknown 21.0.0

Microsoft Dynamics 365 Business Central 2023 Release Wave 1 Unknown 22.0.0

Microsoft Dynamics 365 Business Central 2023 Release Wave 2 Unknown 23.0.0

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisory

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre DatabaseMicrosoft Feed
.