KLA63963 Multiple vulnerabilities in Microsoft Dynamics

Multiple vulnerabilities were found in Microsoft Dynamics. Malicious users can exploit these vulnerabilities to perform cross-site scripting attack, spoof user interface, obtain sensitive information.

Below is a complete list of vulnerabilities:

1. A cross-site-scripting (XSS) vulnerability Microsoft Dynamics 365 (on-premises) can be exploited remotely to spoof user interface.
2. A spoofing vulnerability in Dynamics 365 Sales can be exploited remotely to spoof user interface.
3. A cross-site-scripting (XSS) vulnerability Microsoft Dynamics 365 Customer Engagement can be exploited remotely to spoof user interface.
4. An information disclosure vulnerability in Microsoft Dynamics Business Central/NAV can be exploited remotely to obtain sensitive information.
5. A spoofing vulnerability in Dynamics 365 Field Service can be exploited remotely to spoof user interface.

Original advisories

CVE-2024-21393

CVE-2024-21328

CVE-2024-21327

CVE-2024-21389

CVE-2024-21396

CVE-2024-21380

CVE-2024-21394

CVE-2024-21395

Related products

Microsoft-Dynamics-365

CVE list

CVE-2024-21393 critical

CVE-2024-21328 critical

CVE-2024-21327 critical

CVE-2024-21389 critical

CVE-2024-21396 critical

CVE-2024-21380 critical

CVE-2024-21394 critical

CVE-2024-21395 critical

KB list

5035205

5035207

5035110

5035206

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• XSS/CSS

Cross site scripting. Exploitation of vulnerabilities with this impact can lead to partial interception of information transmitted between user and site.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• Microsoft Dynamics 365 Business Central 2023 Release Wave 2Microsoft Dynamics 365 Customer Engagement V9.1Microsoft Dynamics 365 (on-premises) version 9.1Microsoft Dynamics 365 Business Central 2023 Release Wave 1Microsoft Dynamics 365 Business Central 2022 Release Wave 2