MSRC-CVE-2022-23259 — Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability

Summary

Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

How could an attacker exploit this vulnerability?
An authenticated user could run a specially crafted trusted solution package to execute arbitrary SQL commands. From there the attacker could escalate and execute commands as db_owner within their Dynamics CRM database.

Security updates
9.0.37.2 — https://support.microsoft.com/help/5012732
9.1.9.8 — https://support.microsoft.com/help/5012731

Vulnerabilities 1

High 8.8

CVE-2022-23259

Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability

Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability

Microsoft Microsoft Dynamics 365 (on-premises) version 9.0 Microsoft Dynamics 365 (on-premises) version 9.1

Apr 15, 2022

Revision history

2022-04-12 #1
Information published.

References

CVE-2022-23259 Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23259
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss