Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability

A vulnerability in Microsoft Dynamics 365 on-premises allows unauthorized users to access sensitive information that should be restricted. This happens due to improper access controls, potentially exposing confidential business data.

CWE-643 (XML External Entity Processing) enables information disclosure in Dynamics 365 on-premises through improper authorization checks. An authenticated attacker can exploit insufficient access control mechanisms to retrieve sensitive data; mitigation requires proper access validation and security configuration review.