Skip to content
OpenAdvisories
High MSRC-CVE-2023-38167 1 CVE

Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability

Published Aug 8, 2023 · Updated Aug 10, 2026 · Revision 3

Vendor: Microsoft

Summary

Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

According to the CVSS metric, privileges required is high (PR:H). What privileges does an attacker require to exploit this vulnerability?
Successful exploitation of this vulnerability requires an attacker to already have admin or high privilege access to a security group within the tenant.

Is the update for Microsoft Dynamics 365 Business Central 2023 Release Wave 1 listed in this vulnerability currently available?
The security update for Microsoft Dynamics 365 Business Central 2023 Release Wave 1 is not immediately available. The update will be released as soon as possible, and when it is available, customers will be notified via a revision to this CVE information.
August 15. 2023 Update: The security update for Microsoft Dynamics 365 Business Central 2023 Release Wave 1 is now available. Customers running Microsoft Dynamics 365 Business Central 2023 Release Wave 1 should install the update to be protected from the vulnerability.

Security updates
22.0.59520 — https://support.microsoft.com/help/5029765

Vulnerabilities 1

Revision history

  1. #3

    Updated the build numbers. This is an informational update only.

  2. #2

    In the Security Updates table, made the following revision: The security update for Microsoft Dynamics 365 Business Central 2023 Release Wave 1 is now available. Customers running this affected version of Microsoft Dynamics 365 Business Central 2023 should install the update to be protected from this vulnerability.

  3. #1

    Information published.

References