CVE-2024-35260

2024-06-2718:15:18

CWE-426

microsoft

web.nvd.nist.gov

cve-2024-35260

microsoft dataverse

remote code execution

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS

0.001

Percentile

19.4%

JSON

An authenticated attacker can exploit an Untrusted Search Path vulnerability in Microsoft Dataverse to execute code over a network.

Affected configurations

Vulners

Node

microsoftpower_platformMatchn\/a

VendorProductVersionCPE
microsoftpower_platformn/acpe:2.3:a:microsoft:power_platform:n\/a:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
microsoft	power_platform	n/a	cpe:2.3:a:microsoft:power_platform:n\/a:::::::*

CNA Affected

[
  {
    "vendor": "Microsoft",
    "product": "Microsoft Power Platform",
    "cpes": [
      "cpe:2.3:a:microsoft:power_platform:*:*:*:*:*:*:*:*"
    ],
    "platforms": [
      "Unknown"
    ],
    "versions": [
      {
        "version": "N/A",
        "status": "affected"
      }
    ]
  }
]