CVE-2019-1229: vulnerability in Microsoft Dynamics 365 (on-premises) version 9.0
Dynamics On-Premise Elevation of Privilege Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 3.5%
An elevation of privilege vulnerability exists in Dynamics On-Premise v9. An attacker who successfully exploited the vulnerability could leverage a customizer privilege within Dynamics to gain control of the Web Role hosting the Dynamics installation.
To exploit this vulnerability, an attacker needs to have credentials for a user that has permission to author customized business rules in Dynamics, and persist XAML script in a way that causes it to be interpreted as code.
The update addresses the vulnerability by restricting XAML activities to a whitelisted set.
Affected products
Microsoft · Microsoft Dynamics 365 (on-premises) version 9.0Related CVEs — Microsoft Dynamics 365 (on-premises) version 9.0
In the same product, most dangerous first.
CVE-2021-34524HIGHMicrosoft Dynamics 365 On-Premises Remote Code Execution VulnerabilityEPSS 3.6%CVE-2020-16862HIGHMicrosoft Dynamics 365 (on-premises) Remote Code Execution VulnerabilityEPSS 3.4%CVE-2021-24101MEDIUMMicrosoft Dataverse Information Disclosure VulnerabilityEPSS 3.1%CVE-2022-23259HIGHMicrosoft Dynamics 365 On-Premises Remote Code Execution VulnerabilityEPSS 2.9%CVE-2020-16860MEDIUMMicrosoft Dynamics 365 (on-premises) Remote Code Execution VulnerabilityEPSS 2.7%CVE-2022-21957HIGHMicrosoft Dynamics 365 On-Premises Remote Code Execution VulnerabilityEPSS 2.7%