7.3
High
CVE-2024-35248 Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
Description
Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:CExploitable remotely over the network, without an account and without any user action; the impact on data or service is limited.
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- Interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft Dynamics 365 Business Central 2023 Release Wave 1 22.0 | 22.0.0 → < 23.0.18933 | 23.0.18933 |
| Microsoft Dynamics 365 Business Central 2023 Release Wave 2 23.0 | 23.0.0 → < 23.0.18933 | 23.0.18933 |
| Microsoft Dynamics 365 Business Central 2024 Release Wave 1 24.0 | 24.0 → < 24.0.19487 | 24.0.19487 |
References
- Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability msrc.microsoft.com
Timeline
- Published
- Last modified
Other CVEs of Microsoft Dynamics 365 Business Central 2023 Release Wave 1
The 5 CVEs of Microsoft Dynamics 365 Business Central 2023 Release Wave 1 →
CVE-2024-38225
Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
8.8
High
CVE-2024-35249
Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability
8.8
High
CVE-2024-21380
Microsoft Dynamics Business Central/NAV Information Disclosure Vulnerability
8.0
High
CVE-2023-38167
Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
7.2
High