Not rated
CVE-2019-1229 An elevation of privilege vulnerability exists in Dynamics On-Premise v9
Description
An elevation of privilege vulnerability exists in Dynamics On-Premise v9. An attacker who successfully exploited the vulnerability could leverage a customizer privilege within Dynamics to gain control of the Web Role hosting the Dynamics installation. To exploit this vulnerability, an attacker needs to have credentials for a user that has permission to author customized business rules in Dynamics, and persist XAML script in a way that causes it to be interpreted as code. The update addresses the vulnerability by restricting XAML activities to a whitelisted set.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft Dynamics 365 (on-premises) version 9.0 9.0 | 9.0.0 → latest | No fix stated |
References
- portal.msrc.microsoft.com portal.msrc.microsoft.com
Timeline
- Published
- Last modified
Other CVEs of Microsoft Dynamics 365 (on-premises) version 9.0
The 51 CVEs of Microsoft Dynamics 365 (on-premises) version 9.0 →
CVE-2026-33103
Improper access control in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information…
5.5
Medium
CVE-2023-36020
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
7.6
High
CVE-2023-36016
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
6.2
Medium
CVE-2023-36030
Microsoft Dynamics 365 Sales Spoofing Vulnerability
6.1
Medium