cvelistv5 - cve-2024-38225

CVE-2024-38225 (GCVE-0-2024-38225)

Vulnerability from cvelistv5

Published

2024-09-10 16:53

Modified

2024-12-31 23:03

Severity ?

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

CWE

CWE-287 - Improper Authentication

Summary

Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability

References

URL

msrc_cve-2024-38225

Vulnerability from csaf_microsoft

Published

2024-09-10 07:00

Modified

2024-09-10 07:00

Summary

Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability

Notes

Additional Resources

To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

Disclaimer

The information provided in the Microsoft Knowledge Base is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Customer Action

Required. The vulnerability documented by this CVE requires customer action to resolve.

JSON

To clipboard

{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "cjm00n with Cyber Kunlun \u0026amp; Zhiniang Peng"
        ]
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.microsoft.com/en-us/msrc/security-update-severity-rating-system",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      },
      {
        "category": "general",
        "text": "Required. The vulnerability documented by this CVE requires customer action to resolve.",
        "title": "Customer Action"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2024-38225 Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability - HTML",
        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38225"
      },
      {
        "category": "self",
        "summary": "CVE-2024-38225 Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability - CSAF",
        "url": "https://msrc.microsoft.com/csaf/2024/msrc_cve-2024-38225.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Exploitability Index",
        "url": "https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability",
    "tracking": {
      "current_release_date": "2024-09-10T07:00:00.000Z",
      "generator": {
        "date": "2024-12-31T23:02:29.801Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2024-38225",
      "initial_release_date": "2024-09-10T07:00:00.000Z",
      "revision_history": [
        {
          "date": "2024-09-10T07:00:00.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003cApp Build 22.16.64731, Platform Build 22.0.64727",
            "product": {
              "name": "Microsoft Dynamics 365 Business Central 2023 Release Wave 1 \u003cApp Build 22.16.64731, Platform Build 22.0.64727",
              "product_id": "3"
            }
          },
          {
            "category": "product_version",
            "name": "App Build 22.16.64731, Platform Build 22.0.64727",
            "product": {
              "name": "Microsoft Dynamics 365 Business Central 2023 Release Wave 1 App Build 22.16.64731, Platform Build 22.0.64727",
              "product_id": "12219"
            }
          }
        ],
        "category": "product_name",
        "name": "Microsoft Dynamics 365 Business Central 2023 Release Wave 1"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003cApp Build 23.10.22604, Platform Build 23.0.22561",
            "product": {
              "name": "Microsoft Dynamics 365 Business Central 2024 Release Wave 1 \u003cApp Build 23.10.22604, Platform Build 23.0.22561",
              "product_id": "1"
            }
          },
          {
            "category": "product_version",
            "name": "App Build 23.10.22604, Platform Build 23.0.22561",
            "product": {
              "name": "Microsoft Dynamics 365 Business Central 2024 Release Wave 1 App Build 23.10.22604, Platform Build 23.0.22561",
              "product_id": "12341"
            }
          }
        ],
        "category": "product_name",
        "name": "Microsoft Dynamics 365 Business Central 2024 Release Wave 1"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003cApp Build 24.4. 22925, Platform Build 24.0. 22865",
            "product": {
              "name": "Microsoft Dynamics 365 Business Central 2023 Release Wave 2 \u003cApp Build 24.4. 22925, Platform Build 24.0. 22865",
              "product_id": "2"
            }
          },
          {
            "category": "product_version",
            "name": "App Build 24.4. 22925, Platform Build 24.0. 22865",
            "product": {
              "name": "Microsoft Dynamics 365 Business Central 2023 Release Wave 2 App Build 24.4. 22925, Platform Build 24.0. 22865",
              "product_id": "12294"
            }
          }
        ],
        "category": "product_name",
        "name": "Microsoft Dynamics 365 Business Central 2023 Release Wave 2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-38225",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "notes": [
        {
          "category": "general",
          "text": "Microsoft",
          "title": "Assigning CNA"
        },
        {
          "category": "faq",
          "text": "An attacker needs to edit the local configuration file to contain malicious code, then send the request to the server to exploit this vulnerability.",
          "title": "How could an attacker exploit this vulnerability?"
        },
        {
          "category": "faq",
          "text": "An attacker who successfully exploited this vulnerability could gain administrator privileges.",
          "title": "What privileges could be gained by an attacker who successfully exploited the vulnerability?"
        }
      ],
      "product_status": {
        "fixed": [
          "12219",
          "12294",
          "12341"
        ],
        "known_affected": [
          "1",
          "2",
          "3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-38225 Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability - HTML",
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38225"
        },
        {
          "category": "self",
          "summary": "CVE-2024-38225 Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability - CSAF",
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38225"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-09-10T07:00:00.000Z",
          "details": "App Build 22.16.64731, Platform Build 22.0.64727:Security Update:http://support.microsoft.com/kb/5042528",
          "product_ids": [
            "3"
          ],
          "url": "http://support.microsoft.com/kb/5042528"
        },
        {
          "category": "vendor_fix",
          "date": "2024-09-10T07:00:00.000Z",
          "details": "App Build 23.10.22604, Platform Build 23.0.22561:Security Update:http://support.microsoft.com/kb/5042529",
          "product_ids": [
            "1"
          ],
          "url": "http://support.microsoft.com/kb/5042529"
        },
        {
          "category": "vendor_fix",
          "date": "2024-09-10T07:00:00.000Z",
          "details": "App Build 24.4. 22925, Platform Build 24.0. 22865:Security Update:http://support.microsoft.com/kb/5042530",
          "product_ids": [
            "2"
          ],
          "url": "http://support.microsoft.com/kb/5042530"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalsScore": 0.0,
            "exploitCodeMaturity": "UNPROVEN",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 7.7,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Elevation of Privilege"
        },
        {
          "category": "exploit_status",
          "details": "Exploited:No;Latest Software Release:Exploitation Less Likely"
        }
      ],
      "title": "Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability"
    }
  ]
}

WID-SEC-W-2024-2122

Vulnerability from csaf_certbund

Published

2024-09-10 22:00

Modified

2024-09-10 22:00

Summary

Microsoft Dynamics 365: Mehrere Schwachstellen

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

Microsoft Dynamics 365 ist eine All-in-One-Unternehmensmanagementlösung.

Angriff

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Microsoft Dynamics 365 ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen oder einen Spoofing-Angriff durchzuführen.

Betroffene Betriebssysteme

- Windows

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Microsoft Dynamics 365 ist eine All-in-One-Unternehmensmanagementl\u00f6sung.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Microsoft Dynamics 365 ausnutzen, um seine Privilegien zu erh\u00f6hen, beliebigen Code auszuf\u00fchren oder einen Spoofing-Angriff durchzuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-2122 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-2122.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-2122 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-2122"
      },
      {
        "category": "external",
        "summary": "Microsoft Leitfaden f\u00fcr Sicherheitsupdates vom 2024-09-10",
        "url": "https://msrc.microsoft.com/update-guide"
      }
    ],
    "source_lang": "en-US",
    "title": "Microsoft Dynamics 365: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2024-09-10T22:00:00.000+00:00",
      "generator": {
        "date": "2024-09-11T10:38:46.874+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.6"
        }
      },
      "id": "WID-SEC-W-2024-2122",
      "initial_release_date": "2024-09-10T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-09-10T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "Business Central 2024 Release Wave 1",
                "product": {
                  "name": "Microsoft Dynamics 365 Business Central 2024 Release Wave 1",
                  "product_id": "T026286",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:microsoft:dynamics_365:unified_service_desk"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Business Central 2023 Release Wave 1",
                "product": {
                  "name": "Microsoft Dynamics 365 Business Central 2023 Release Wave 1",
                  "product_id": "T029138",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:microsoft:dynamics_365:business_central_2023_release_wave_1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Business Central 2023 Release Wave 2",
                "product": {
                  "name": "Microsoft Dynamics 365 Business Central 2023 Release Wave 2",
                  "product_id": "T032742",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:microsoft:dynamics_365:business_central_2023_release_wave_2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "(on-premises) version 9.1",
                "product": {
                  "name": "Microsoft Dynamics 365 (on-premises) version 9.1",
                  "product_id": "T036767",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:microsoft:dynamics_365:%28on-premises%29_version_9.1"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Dynamics 365"
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-38225",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Microsoft Dynamics 365. Diese Fehler wurden noch nicht im Detail ver\u00f6ffentlicht. Ein entfernter, authentifizierter Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien auf Administratorrechte zu erh\u00f6hen, beliebigen Code auszuf\u00fchren oder einen Spoofing-Angriff durchzuf\u00fchren. Einige dieser Sicherheitsl\u00fccken erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T032742",
          "T036767",
          "T029138",
          "T026286"
        ]
      },
      "release_date": "2024-09-10T22:00:00.000+00:00",
      "title": "CVE-2024-38225"
    },
    {
      "cve": "CVE-2024-43476",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Microsoft Dynamics 365. Diese Fehler wurden noch nicht im Detail ver\u00f6ffentlicht. Ein entfernter, authentifizierter Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien auf Administratorrechte zu erh\u00f6hen, beliebigen Code auszuf\u00fchren oder einen Spoofing-Angriff durchzuf\u00fchren. Einige dieser Sicherheitsl\u00fccken erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T032742",
          "T036767",
          "T029138",
          "T026286"
        ]
      },
      "release_date": "2024-09-10T22:00:00.000+00:00",
      "title": "CVE-2024-43476"
    },
    {
      "cve": "CVE-2024-43479",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Microsoft Dynamics 365. Diese Fehler wurden noch nicht im Detail ver\u00f6ffentlicht. Ein entfernter, authentifizierter Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien auf Administratorrechte zu erh\u00f6hen, beliebigen Code auszuf\u00fchren oder einen Spoofing-Angriff durchzuf\u00fchren. Einige dieser Sicherheitsl\u00fccken erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T032742",
          "T036767",
          "T029138",
          "T026286"
        ]
      },
      "release_date": "2024-09-10T22:00:00.000+00:00",
      "title": "CVE-2024-43479"
    }
  ]
}

wid-sec-w-2024-2122

Vulnerability from csaf_certbund

Published

2024-09-10 22:00

Modified

2024-09-10 22:00

Summary

Microsoft Dynamics 365: Mehrere Schwachstellen

Notes

Produktbeschreibung

Microsoft Dynamics 365 ist eine All-in-One-Unternehmensmanagementlösung.

Angriff

Betroffene Betriebssysteme

- Windows

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Microsoft Dynamics 365 ist eine All-in-One-Unternehmensmanagementl\u00f6sung.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Microsoft Dynamics 365 ausnutzen, um seine Privilegien zu erh\u00f6hen, beliebigen Code auszuf\u00fchren oder einen Spoofing-Angriff durchzuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-2122 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-2122.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-2122 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-2122"
      },
      {
        "category": "external",
        "summary": "Microsoft Leitfaden f\u00fcr Sicherheitsupdates vom 2024-09-10",
        "url": "https://msrc.microsoft.com/update-guide"
      }
    ],
    "source_lang": "en-US",
    "title": "Microsoft Dynamics 365: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2024-09-10T22:00:00.000+00:00",
      "generator": {
        "date": "2024-09-11T10:38:46.874+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.6"
        }
      },
      "id": "WID-SEC-W-2024-2122",
      "initial_release_date": "2024-09-10T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-09-10T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "Business Central 2024 Release Wave 1",
                "product": {
                  "name": "Microsoft Dynamics 365 Business Central 2024 Release Wave 1",
                  "product_id": "T026286",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:microsoft:dynamics_365:unified_service_desk"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Business Central 2023 Release Wave 1",
                "product": {
                  "name": "Microsoft Dynamics 365 Business Central 2023 Release Wave 1",
                  "product_id": "T029138",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:microsoft:dynamics_365:business_central_2023_release_wave_1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Business Central 2023 Release Wave 2",
                "product": {
                  "name": "Microsoft Dynamics 365 Business Central 2023 Release Wave 2",
                  "product_id": "T032742",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:microsoft:dynamics_365:business_central_2023_release_wave_2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "(on-premises) version 9.1",
                "product": {
                  "name": "Microsoft Dynamics 365 (on-premises) version 9.1",
                  "product_id": "T036767",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:microsoft:dynamics_365:%28on-premises%29_version_9.1"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Dynamics 365"
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-38225",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Microsoft Dynamics 365. Diese Fehler wurden noch nicht im Detail ver\u00f6ffentlicht. Ein entfernter, authentifizierter Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien auf Administratorrechte zu erh\u00f6hen, beliebigen Code auszuf\u00fchren oder einen Spoofing-Angriff durchzuf\u00fchren. Einige dieser Sicherheitsl\u00fccken erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T032742",
          "T036767",
          "T029138",
          "T026286"
        ]
      },
      "release_date": "2024-09-10T22:00:00.000+00:00",
      "title": "CVE-2024-38225"
    },
    {
      "cve": "CVE-2024-43476",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Microsoft Dynamics 365. Diese Fehler wurden noch nicht im Detail ver\u00f6ffentlicht. Ein entfernter, authentifizierter Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien auf Administratorrechte zu erh\u00f6hen, beliebigen Code auszuf\u00fchren oder einen Spoofing-Angriff durchzuf\u00fchren. Einige dieser Sicherheitsl\u00fccken erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T032742",
          "T036767",
          "T029138",
          "T026286"
        ]
      },
      "release_date": "2024-09-10T22:00:00.000+00:00",
      "title": "CVE-2024-43476"
    },
    {
      "cve": "CVE-2024-43479",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in Microsoft Dynamics 365. Diese Fehler wurden noch nicht im Detail ver\u00f6ffentlicht. Ein entfernter, authentifizierter Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien auf Administratorrechte zu erh\u00f6hen, beliebigen Code auszuf\u00fchren oder einen Spoofing-Angriff durchzuf\u00fchren. Einige dieser Sicherheitsl\u00fccken erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T032742",
          "T036767",
          "T029138",
          "T026286"
        ]
      },
      "release_date": "2024-09-10T22:00:00.000+00:00",
      "title": "CVE-2024-43479"
    }
  ]
}

fkie_cve-2024-38225

Vulnerability from fkie_nvd

Published

2024-09-10 17:15

Modified

2024-09-17 16:58

Severity ?

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability

References

	URL	Tags
	secure@microsoft.com	https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38225	Patch, Vendor Advisory

Impacted products

Vendor	Product	Version
microsoft	dynamics_365_business_central	2023
microsoft	dynamics_365_business_central	2023
microsoft	dynamics_365_business_central	2024

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central:2023:release_wave_1:*:*:*:*:*:*",
              "matchCriteriaId": "EC16B684-C9B0-4F02-A5ED-20CBCDFD9191",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central:2023:release_wave_2:*:*:*:*:*:*",
              "matchCriteriaId": "8E174DED-BAE1-4377-8D65-DBF2B7CCF9D8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central:2024:release_wave_1:*:*:*:*:*:*",
              "matchCriteriaId": "0BCF31A9-84D3-4494-B3C3-65CFF284921D",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability"
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de elevaci\u00f3n de privilegios en Microsoft Dynamics 365 Business Central"
    }
  ],
  "id": "CVE-2024-38225",
  "lastModified": "2024-09-17T16:58:39.197",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "secure@microsoft.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2024-09-10T17:15:25.063",
  "references": [
    {
      "source": "secure@microsoft.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38225"
    }
  ],
  "sourceIdentifier": "secure@microsoft.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ],
      "source": "secure@microsoft.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

NCSC-2024-0367

Vulnerability from csaf_ncscnl

Published

2024-09-10 18:28

Modified

2024-09-10 18:28

Summary

Kwetsbaarheden verholpen in Microsoft Dynamics

Notes

The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions: NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory. This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.

Feiten

Microsoft heeft kwetsbaarheden verholpen in Dynamics.

Interpretaties

Een kwaadwillende kan de kwetsbaarheden misbruiken om zich verhoogde rechten toe te kennen en zo mogelijk code uit te voeren binnen de applicatie, of om een Cross-Site-Scripting-aanval uit te voeren. Een dergelijke aanval kan leiden tot uitvoer van code in de browser van het slachtoffer, of toegang tot gevoelige gegevens in de context van de browser van het slachtoffer. ``` Dynamics Business Central: |----------------|------|-------------------------------------| | CVE-ID | CVSS | Impact | |----------------|------|-------------------------------------| | CVE-2024-38225 | 8.80 | Verkrijgen van verhoogde rechten | |----------------|------|-------------------------------------| Microsoft Dynamics 365 (on-premises): |----------------|------|-------------------------------------| | CVE-ID | CVSS | Impact | |----------------|------|-------------------------------------| | CVE-2024-43476 | 7.60 | Voordoen als andere gebruiker | |----------------|------|-------------------------------------| Power Automate: |----------------|------|-------------------------------------| | CVE-ID | CVSS | Impact | |----------------|------|-------------------------------------| | CVE-2024-43479 | 8.50 | Uitvoeren van willekeurige code | |----------------|------|-------------------------------------| ```

Oplossingen

Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op: https://portal.msrc.microsoft.com/en-us/security-guidance

Kans

medium

Schade

high

CWE-284

Improper Access Control

CWE-287

Improper Authentication

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

JSON

To clipboard

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Microsoft heeft kwetsbaarheden verholpen in Dynamics.",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "Een kwaadwillende kan de kwetsbaarheden misbruiken om zich verhoogde rechten toe te kennen en zo mogelijk code uit te voeren binnen de applicatie, of om een Cross-Site-Scripting-aanval uit te voeren. Een dergelijke aanval kan leiden tot uitvoer van code in de browser van het slachtoffer, of toegang tot gevoelige gegevens in de context van de browser van het slachtoffer.\n\n```\nDynamics Business Central: \n|----------------|------|-------------------------------------|\n| CVE-ID         | CVSS | Impact                              |\n|----------------|------|-------------------------------------|\n| CVE-2024-38225 | 8.80 | Verkrijgen van verhoogde rechten    | \n|----------------|------|-------------------------------------|\n\nMicrosoft Dynamics 365 (on-premises): \n|----------------|------|-------------------------------------|\n| CVE-ID         | CVSS | Impact                              |\n|----------------|------|-------------------------------------|\n| CVE-2024-43476 | 7.60 | Voordoen als andere gebruiker       | \n|----------------|------|-------------------------------------|\n\nPower Automate: \n|----------------|------|-------------------------------------|\n| CVE-ID         | CVSS | Impact                              |\n|----------------|------|-------------------------------------|\n| CVE-2024-43479 | 8.50 | Uitvoeren van willekeurige code     | \n|----------------|------|-------------------------------------|\n```",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op:\n\nhttps://portal.msrc.microsoft.com/en-us/security-guidance",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Improper Access Control",
        "title": "CWE-284"
      },
      {
        "category": "general",
        "text": "Improper Authentication",
        "title": "CWE-287"
      },
      {
        "category": "general",
        "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
        "title": "CWE-79"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "title": "Kwetsbaarheden verholpen in Microsoft Dynamics",
    "tracking": {
      "current_release_date": "2024-09-10T18:28:04.110959Z",
      "id": "NCSC-2024-0367",
      "initial_release_date": "2024-09-10T18:28:04.110959Z",
      "revision_history": [
        {
          "date": "2024-09-10T18:28:04.110959Z",
          "number": "0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "dynamics_365",
            "product": {
              "name": "dynamics_365",
              "product_id": "CSAFPID-2544",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:microsoft:dynamics_365:9.1:*:*:*:on-premises:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "dynamics_365_business_central",
            "product": {
              "name": "dynamics_365_business_central",
              "product_id": "CSAFPID-345755",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:microsoft:dynamics_365_business_central:2023:release_wave_1:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "dynamics_365_business_central",
            "product": {
              "name": "dynamics_365_business_central",
              "product_id": "CSAFPID-838651",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:microsoft:dynamics_365_business_central:2023:release_wave_2:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "dynamics_365_business_central",
            "product": {
              "name": "dynamics_365_business_central",
              "product_id": "CSAFPID-1484922",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:microsoft:dynamics_365_business_central:2024:release_wave_1:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "microsoft_dynamics_365__on-premises__version_9.1",
            "product": {
              "name": "microsoft_dynamics_365__on-premises__version_9.1",
              "product_id": "CSAFPID-1455733",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:microsoft:microsoft_dynamics_365__on-premises__version_9.1:9.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "microsoft_dynamics_365_business_central_2023_release_wave_1",
            "product": {
              "name": "microsoft_dynamics_365_business_central_2023_release_wave_1",
              "product_id": "CSAFPID-1455692",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:microsoft:microsoft_dynamics_365_business_central_2023_release_wave_1:22.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "microsoft_dynamics_365_business_central_2023_release_wave_2",
            "product": {
              "name": "microsoft_dynamics_365_business_central_2023_release_wave_2",
              "product_id": "CSAFPID-1455773",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:microsoft:microsoft_dynamics_365_business_central_2023_release_wave_2:23.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "microsoft_dynamics_365_business_central_2024_release_wave_1",
            "product": {
              "name": "microsoft_dynamics_365_business_central_2024_release_wave_1",
              "product_id": "CSAFPID-1477296",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:microsoft:microsoft_dynamics_365_business_central_2024_release_wave_1:24.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "power_automate_for_desktop",
            "product": {
              "name": "power_automate_for_desktop",
              "product_id": "CSAFPID-1638299",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:microsoft:power_automate_for_desktop:1.0.0.0:*:*:*:*:*:*:*"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "microsoft"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-38225",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Authentication",
          "title": "CWE-287"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1455692",
          "CSAFPID-1477296",
          "CSAFPID-1455773",
          "CSAFPID-838651",
          "CSAFPID-345755",
          "CSAFPID-1484922"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-38225",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-38225.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1455692",
            "CSAFPID-1477296",
            "CSAFPID-1455773",
            "CSAFPID-838651",
            "CSAFPID-345755",
            "CSAFPID-1484922"
          ]
        }
      ],
      "title": "CVE-2024-38225"
    },
    {
      "cve": "CVE-2024-43476",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1455733",
          "CSAFPID-2544"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-43476",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-43476.json"
        }
      ],
      "title": "CVE-2024-43476"
    },
    {
      "cve": "CVE-2024-43479",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Access Control",
          "title": "CWE-284"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1638299"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-43479",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-43479.json"
        }
      ],
      "title": "CVE-2024-43479"
    }
  ]
}

ncsc-2024-0367

Vulnerability from csaf_ncscnl

Published

2024-09-10 18:28

Modified

2024-09-10 18:28

Summary

Kwetsbaarheden verholpen in Microsoft Dynamics

Notes

Feiten

Microsoft heeft kwetsbaarheden verholpen in Dynamics.

Interpretaties

Oplossingen

Kans

medium

Schade

high

CWE-284

Improper Access Control

CWE-287

Improper Authentication

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

JSON

To clipboard

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Microsoft heeft kwetsbaarheden verholpen in Dynamics.",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "Een kwaadwillende kan de kwetsbaarheden misbruiken om zich verhoogde rechten toe te kennen en zo mogelijk code uit te voeren binnen de applicatie, of om een Cross-Site-Scripting-aanval uit te voeren. Een dergelijke aanval kan leiden tot uitvoer van code in de browser van het slachtoffer, of toegang tot gevoelige gegevens in de context van de browser van het slachtoffer.\n\n```\nDynamics Business Central: \n|----------------|------|-------------------------------------|\n| CVE-ID         | CVSS | Impact                              |\n|----------------|------|-------------------------------------|\n| CVE-2024-38225 | 8.80 | Verkrijgen van verhoogde rechten    | \n|----------------|------|-------------------------------------|\n\nMicrosoft Dynamics 365 (on-premises): \n|----------------|------|-------------------------------------|\n| CVE-ID         | CVSS | Impact                              |\n|----------------|------|-------------------------------------|\n| CVE-2024-43476 | 7.60 | Voordoen als andere gebruiker       | \n|----------------|------|-------------------------------------|\n\nPower Automate: \n|----------------|------|-------------------------------------|\n| CVE-ID         | CVSS | Impact                              |\n|----------------|------|-------------------------------------|\n| CVE-2024-43479 | 8.50 | Uitvoeren van willekeurige code     | \n|----------------|------|-------------------------------------|\n```",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op:\n\nhttps://portal.msrc.microsoft.com/en-us/security-guidance",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Improper Access Control",
        "title": "CWE-284"
      },
      {
        "category": "general",
        "text": "Improper Authentication",
        "title": "CWE-287"
      },
      {
        "category": "general",
        "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
        "title": "CWE-79"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "title": "Kwetsbaarheden verholpen in Microsoft Dynamics",
    "tracking": {
      "current_release_date": "2024-09-10T18:28:04.110959Z",
      "id": "NCSC-2024-0367",
      "initial_release_date": "2024-09-10T18:28:04.110959Z",
      "revision_history": [
        {
          "date": "2024-09-10T18:28:04.110959Z",
          "number": "0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "dynamics_365",
            "product": {
              "name": "dynamics_365",
              "product_id": "CSAFPID-2544",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:microsoft:dynamics_365:9.1:*:*:*:on-premises:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "dynamics_365_business_central",
            "product": {
              "name": "dynamics_365_business_central",
              "product_id": "CSAFPID-345755",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:microsoft:dynamics_365_business_central:2023:release_wave_1:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "dynamics_365_business_central",
            "product": {
              "name": "dynamics_365_business_central",
              "product_id": "CSAFPID-838651",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:microsoft:dynamics_365_business_central:2023:release_wave_2:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "dynamics_365_business_central",
            "product": {
              "name": "dynamics_365_business_central",
              "product_id": "CSAFPID-1484922",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:microsoft:dynamics_365_business_central:2024:release_wave_1:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "microsoft_dynamics_365__on-premises__version_9.1",
            "product": {
              "name": "microsoft_dynamics_365__on-premises__version_9.1",
              "product_id": "CSAFPID-1455733",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:microsoft:microsoft_dynamics_365__on-premises__version_9.1:9.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "microsoft_dynamics_365_business_central_2023_release_wave_1",
            "product": {
              "name": "microsoft_dynamics_365_business_central_2023_release_wave_1",
              "product_id": "CSAFPID-1455692",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:microsoft:microsoft_dynamics_365_business_central_2023_release_wave_1:22.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "microsoft_dynamics_365_business_central_2023_release_wave_2",
            "product": {
              "name": "microsoft_dynamics_365_business_central_2023_release_wave_2",
              "product_id": "CSAFPID-1455773",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:microsoft:microsoft_dynamics_365_business_central_2023_release_wave_2:23.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "microsoft_dynamics_365_business_central_2024_release_wave_1",
            "product": {
              "name": "microsoft_dynamics_365_business_central_2024_release_wave_1",
              "product_id": "CSAFPID-1477296",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:microsoft:microsoft_dynamics_365_business_central_2024_release_wave_1:24.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "power_automate_for_desktop",
            "product": {
              "name": "power_automate_for_desktop",
              "product_id": "CSAFPID-1638299",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:microsoft:power_automate_for_desktop:1.0.0.0:*:*:*:*:*:*:*"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "microsoft"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-38225",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Authentication",
          "title": "CWE-287"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1455692",
          "CSAFPID-1477296",
          "CSAFPID-1455773",
          "CSAFPID-838651",
          "CSAFPID-345755",
          "CSAFPID-1484922"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-38225",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-38225.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1455692",
            "CSAFPID-1477296",
            "CSAFPID-1455773",
            "CSAFPID-838651",
            "CSAFPID-345755",
            "CSAFPID-1484922"
          ]
        }
      ],
      "title": "CVE-2024-38225"
    },
    {
      "cve": "CVE-2024-43476",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1455733",
          "CSAFPID-2544"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-43476",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-43476.json"
        }
      ],
      "title": "CVE-2024-43476"
    },
    {
      "cve": "CVE-2024-43479",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Access Control",
          "title": "CWE-284"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1638299"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-43479",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-43479.json"
        }
      ],
      "title": "CVE-2024-43479"
    }
  ]
}

CERTFR-2024-AVI-0761

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Microsoft	N/A	Microsoft SharePoint Server 2019 versions antérieures à 16.0.10414.20002
Microsoft	N/A	Microsoft SharePoint Enterprise Server 2016 versions antérieures à 16.0.5465.1001
Microsoft	N/A	Microsoft SQL Server 2019 pour systèmes x64 (GDR) versions antérieures à 15.0.2120.1
Microsoft	N/A	Microsoft SharePoint Server Subscription Edition versions antérieures à 16.0.17928.20086
Microsoft	N/A	Microsoft SQL Server 2022 pour systèmes x64 (CU 14) versions antérieures à 16.0.4140.3
Microsoft	N/A	Microsoft SQL Server 2016 pour systèmes x64 Service Pack 3 (GDR) versions antérieures à 13.0.6445.1
Microsoft	N/A	Microsoft Visio 2016 (édition 64 bits) versions antérieures à 16.0.5465.1001
Microsoft	N/A	Microsoft SQL Server 2017 pour systèmes x64 (GDR) versions antérieures à 14.0.2060.1
Microsoft	N/A	Microsoft SQL Server 2016 pour systèmes x64 Service Pack 3 Azure Connect Feature Pack versions antérieures à 13.0.7040.1
Microsoft	N/A	Microsoft SQL Server 2019 pour systèmes x64 (CU 28) versions antérieures à 15.0.4390.2
Microsoft	N/A	Microsoft AutoUpdate pour Mac versions antérieures à 4.72
Microsoft	N/A	Power Automate pour Desktop versions antérieures à 2.47.119.24249
Microsoft	N/A	Microsoft Dynamics 365 Business Central 2023 Release Wave 2 versions antérieures à App Build 24.4. 22925, Platform Build 24.0. 22865
Microsoft	N/A	Microsoft Dynamics 365 (on-premises) version 9.1 antérieures à 9.1.32
Microsoft	N/A	Microsoft Dynamics 365 Business Central 2024 Release Wave 1 versions antérieures à App Build 23.10.22604, Platform Build 23.0.22561
Microsoft	N/A	Microsoft Visio 2016 (édition 32 bits) versions antérieures à 16.0.5465.1001
Microsoft	N/A	Microsoft SQL Server 2017 pour systèmes x64 (CU 31) versions antérieures à 14.0.3475.1
Microsoft	N/A	Microsoft Dynamics 365 Business Central 2023 Release Wave 1 versions antérieures à App Build 22.16.64731, Platform Build 22.0.64727
Microsoft	N/A	Microsoft SQL Server 2022 pour systèmes x64 (GDR) versions antérieures à 16.0.1125.1

References

Title

Publication Time

ghsa-pg6q-2w5f-8pw9

Vulnerability from github

Published

2024-09-10 18:30

Modified

2024-09-10 18:30

Severity ?

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-38225"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-10T17:15:25Z",
    "severity": "HIGH"
  },
  "details": "Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability",
  "id": "GHSA-pg6q-2w5f-8pw9",
  "modified": "2024-09-10T18:30:45Z",
  "published": "2024-09-10T18:30:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38225"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38225"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

cnvd-2024-40536

Vulnerability from cnvd

Title

Microsoft Dynamics 365 Business Central权限提升漏洞（CNVD-2024-40536）

Description

Microsoft Dynamics 365 Business Central是一款全面的业务管理解决方案，可帮助中小型公司在单个易于使用的应用程序中连接其财务、销售、服务和运营团队。 Microsoft Dynamics 365 Business Central存在权限提升漏洞，攻击者可利用该漏洞以更高的权限执行任意代码。

Severity

高

Patch Name

Microsoft Dynamics 365 Business Central权限提升漏洞（CNVD-2024-40536）的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38225

Reference

https://cxsecurity.com/cveshow/CVE-2024-38225/

Impacted products

Name
['Microsoft Microsoft Dynamics 365 Business Central 2024 Release Wave 1', 'Microsoft Microsoft Dynamics 365 Business Central 2023 Release Wave 1', 'Microsoft Microsoft Dynamics 365 Business Central 2023 Release Wave 2']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2024-38225",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38225"
    }
  },
  "description": "Microsoft Dynamics 365 Business Central\u662f\u4e00\u6b3e\u5168\u9762\u7684\u4e1a\u52a1\u7ba1\u7406\u89e3\u51b3\u65b9\u6848\uff0c\u53ef\u5e2e\u52a9\u4e2d\u5c0f\u578b\u516c\u53f8\u5728\u5355\u4e2a\u6613\u4e8e\u4f7f\u7528\u7684\u5e94\u7528\u7a0b\u5e8f\u4e2d\u8fde\u63a5\u5176\u8d22\u52a1\u3001\u9500\u552e\u3001\u670d\u52a1\u548c\u8fd0\u8425\u56e2\u961f\u3002\n\nMicrosoft Dynamics 365 Business Central\u5b58\u5728\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u4ee5\u66f4\u9ad8\u7684\u6743\u9650\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38225",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2024-40536",
  "openTime": "2024-10-14",
  "patchDescription": "Microsoft Dynamics 365 Business Central\u662f\u4e00\u6b3e\u5168\u9762\u7684\u4e1a\u52a1\u7ba1\u7406\u89e3\u51b3\u65b9\u6848\uff0c\u53ef\u5e2e\u52a9\u4e2d\u5c0f\u578b\u516c\u53f8\u5728\u5355\u4e2a\u6613\u4e8e\u4f7f\u7528\u7684\u5e94\u7528\u7a0b\u5e8f\u4e2d\u8fde\u63a5\u5176\u8d22\u52a1\u3001\u9500\u552e\u3001\u670d\u52a1\u548c\u8fd0\u8425\u56e2\u961f\u3002\r\n\r\nMicrosoft Dynamics 365 Business Central\u5b58\u5728\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u4ee5\u66f4\u9ad8\u7684\u6743\u9650\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Microsoft Dynamics 365 Business Central\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff08CNVD-2024-40536\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Microsoft Microsoft Dynamics 365 Business Central 2024 Release Wave 1",
      "Microsoft Microsoft Dynamics 365 Business Central 2023 Release Wave 1",
      "Microsoft Microsoft Dynamics 365 Business Central 2023 Release Wave 2"
    ]
  },
  "referenceLink": "https://cxsecurity.com/cveshow/CVE-2024-38225/",
  "serverity": "\u9ad8",
  "submitTime": "2024-09-12",
  "title": "Microsoft Dynamics 365 Business Central\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff08CNVD-2024-40536\uff09"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2024-38225 (GCVE-0-2024-38225)

Vulnerability from cvelistv5

Vulnerability from csaf_microsoft

Vulnerability from csaf_certbund

Vulnerability from csaf_certbund

Vulnerability from fkie_nvd

Vulnerability from csaf_ncscnl

Vulnerability from csaf_ncscnl

Vulnerability from certfr_avis

Solutions

Vulnerability from github

Vulnerability from cnvd

Tags

Sightings

Nomenclature