CVE-2019-1229: falha em Microsoft Dynamics 365 (on-premises) version 9.0
Dynamics On-Premise Elevation of Privilege Vulnerability
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 3.5%
An elevation of privilege vulnerability exists in Dynamics On-Premise v9. An attacker who successfully exploited the vulnerability could leverage a customizer privilege within Dynamics to gain control of the Web Role hosting the Dynamics installation.
To exploit this vulnerability, an attacker needs to have credentials for a user that has permission to author customized business rules in Dynamics, and persist XAML script in a way that causes it to be interpreted as code.
The update addresses the vulnerability by restricting XAML activities to a whitelisted set.
Produtos afetados
Microsoft · Microsoft Dynamics 365 (on-premises) version 9.0CVEs relacionadas — Microsoft Dynamics 365 (on-premises) version 9.0
No mesmo produto, das mais perigosas para as menos.
CVE-2021-34524HIGHMicrosoft Dynamics 365 On-Premises Remote Code Execution VulnerabilityEPSS 3.6%CVE-2020-16862HIGHMicrosoft Dynamics 365 (on-premises) Remote Code Execution VulnerabilityEPSS 3.4%CVE-2021-24101MEDIUMMicrosoft Dataverse Information Disclosure VulnerabilityEPSS 3.1%CVE-2022-23259HIGHMicrosoft Dynamics 365 On-Premises Remote Code Execution VulnerabilityEPSS 2.9%CVE-2020-16860MEDIUMMicrosoft Dynamics 365 (on-premises) Remote Code Execution VulnerabilityEPSS 2.7%CVE-2022-21957HIGHMicrosoft Dynamics 365 On-Premises Remote Code Execution VulnerabilityEPSS 2.7%