MSRC-CVE-2024-35263 — Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability

Summary

Impact: Information Disclosure. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?
Any authenticated attacker could trigger this vulnerability. It does not require admin or other elevated privileges.

What type of information could be disclosed by this vulnerability?
This vulnerability allows exfiltration of all the data that the logged-in user can access.

Security updates
1.29 — https://support.microsoft.com/help/5039459

Vulnerabilities 1

Medium 5.7

CVE-2024-35263

Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability

Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability

Microsoft Microsoft Dynamics 365 (on-premises) version 9.1

Jun 11, 2024

Revision history

2024-06-11 #1
Information published.

References

CVE-2024-35263 Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35263
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss