CVE-2024-35249
HighCVSS 8.8Exploitation Probability (EPSS)
High risk88th percentile - higher than 88% of all known CVEs
Summary
A remote code execution vulnerability in Microsoft Dynamics 365 Business Central allows an attacker to execute arbitrary code in the context of the application. It requires authentication and user interaction.
Risk Assessment
The risk for the organization includes potential takeover of the ERP system, theft of business data, and disruption of accounting and logistics processes.
Recommendation
It is recommended to immediately apply the security update provided by Microsoft as part of the monthly patches. Also, restrict system access to trusted users only.
Other vulnerabilities in Microsoft Dynamics 365 Business Central
See all- CVE-2024-38225High
Elevation of privilege vulnerability in Microsoft Dynamics 365 Business Central. It allows an attacker to gain higher privileges.
- CVE-2024-35248High
A vulnerability in Microsoft Dynamics 365 Business Central allows elevation of privilege. An attacker could exploit this flaw to gain unauthorized access to system resources.
- CVE-2023-38167High
A vulnerability in Microsoft Dynamics 365 Business Central allows unauthorized users to elevate their privileges. Exploiting this flaw may lead to access to resources that the user should not have access to.
- CVE-2021-34474High
Remote Code Execution vulnerability in Microsoft Dynamics 365 Business Central. An attacker could exploit this vulnerability to execute arbitrary code in the context of the application.
Original NVD description (English source)
Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability