MSRC-CVE-2021-42316 — Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability

Summary

Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

What privileges could an attacker gain with successful exploitation of this vulnerability?
An attacker can write to any file where the webserver user (nt authority\network service) has write access.

Security updates
9.1.6.3 — https://support.microsoft.com/help/5008478
9.0.34.5 — https://support.microsoft.com/help/5008479

Vulnerabilities 1

High 8.8

CVE-2021-42316

Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability

Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability

Microsoft Microsoft Dynamics 365 (on-premises) version 9.0 Microsoft Dynamics 365 (on-premises) version 9.1

Nov 10, 2021

Revision history

2021-11-12 #2
Added an FAQ and updated the CVSS score. This is an informational change only.
2021-11-09 #1
Information published.

References

CVE-2021-42316 Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42316
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss