CVE-2024-43460

Improper Authorization (CWE-285)

Published: Sep 17, 2024

010
CVSS 8.1EPSS 0.05%High
CVE info copied to clipboard

Summary

Improper authorization in Dynamics 365 Business Central resulted in a vulnerability that allows an authenticated attacker to elevate privileges over a network.

Impact

This vulnerability has a high severity with a CVSS v3.1 base score of 8.8. It affects the confidentiality, integrity, and availability of the system, all with high impact. An authenticated attacker with low privileges can exploit this vulnerability over a network without any user interaction. The attack complexity is low, making it relatively easy to exploit. The potential impacts include unauthorized access to sensitive data, modification of system settings or data, and potential disruption of services.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

A patch is available. Microsoft has released an update to address this vulnerability. The patch was added on September 17, 2024, and is available through the Microsoft Security Response Center.

Mitigation

1. Apply the security update provided by Microsoft as soon as possible. 2. Implement the principle of least privilege, ensuring users have only the necessary permissions. 3. Monitor for suspicious activities, especially privilege escalation attempts. 4. Use network segmentation to limit the potential impact of a successful attack. 5. Regularly audit user permissions and access controls in Dynamics 365 Business Central. 6. Keep all Dynamics 365 Business Central installations up to date with the latest security patches.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C

Timeline

CVE Assignment

NVD published the first details for CVE-2024-43460

Sep 17, 2024 at 7:15 PM
First Article

Feedly found the first article mentioning CVE-2024-43460. See article

Sep 17, 2024 at 7:21 PM / Vulners.com RSS Feed
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Sep 17, 2024 at 7:21 PM
EPSS

EPSS Score was set to: 0.05% (Percentile: 16.8%)

Sep 18, 2024 at 9:31 AM
CVSS

A CVSS base score of 8.8 has been assigned.

Sep 25, 2024 at 7:20 PM / nvd
EPSS

EPSS Score was set to: 0.05% (Percentile: 17.5%)

Nov 19, 2024 at 3:09 PM
Static CVE Timeline Graph

Affected Systems

Microsoft/dynamics_365_business_central
+null more

Patches

Microsoft
+null more

Links to Mitre Att&cks

T1574.010: Services File Permissions Weakness
+null more

Attack Patterns

CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
+null more

References

CVE-2024-43460 - Security Update Guide - Microsoft - Dynamics 365 Business Central Elevation of Privilege Vulnerability
There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).
Dynamics 365 Business Central Elevation of Privilege Vulnerability
Improper authorization in Dynamics 365 Business Central resulted in a vulnerability that allows an authenticated attacker to elevate privileges over a network. Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.

News

CVE-2024-43460 Dynamics 365 Business Central Elevation of Privilege Vulnerability
Vulnerability Summary for the Week of September 16, 2024
High Vulnerabilities Primary Vendor — Product Description Published CVSS Score Source & Patch Info CIRCUTOR–CIRCUTOR Q-SMT CIRCUTOR Q-SMT in its firmware version 1.0.4, could be affected by a denial of service (DoS) attack if an attacker with access to the web service bypasses the authentication mechanisms on the login page, allowing the attacker to use all the functionalities implemented at web level that allow interacting with the device. 2024-09-18 10 CVE-2024-8887 cve-coordination@incibe.es CIRCUTOR–CIRCUTOR Q-SMT An attacker with access to the network where CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could steal the tokens used on the web, since these have no expiration date to access the web application without restrictions. Token theft can originate from different methods such as network captures, locally stored web information, etc. 2024-09-18 10 CVE-2024-8888 cve-coordination@incibe.es dragonflyoss–Dragonfly2 Dragonfly is an open source P2P-based file distribution and image acceleration system. It is hosted by the Cloud Native Computing Foundation (CNCF) as an Incubating Level Project. Dragonfly uses JWT to verify user. However, the secret key for JWT, “Secret Key”, is hard coded, which leads to authentication bypass. An attacker can perform any action as a user with admin privileges. This issue has been addressed in release version 2.0.9. All users are advised to upgrade.
Patch Tuesday October 2024 - Five Zero Days
Besides these zero days we have five CVE's rated critical: These mainly affect Windows OS's as well as MS Configuration Manager and some one offs for Dynamics and the GroupMe app. CVE-2024-43572 is a remote code execution vulnerability with a rating of important.
Improper authorization in Dynamics 365 Business Central resulted in a vulnerability
Improper authorization in Dynamics 365 Business Central resulted in a vulnerability that allows an authenticated attacker to elevate privileges over a network.
US-CERT Vulnerability Summary for the Week of September 16, 2024
The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available. Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores: High : vulnerabilities with a CVSS base score of 7.0–10.0 Medium : vulnerabilities with a CVSS base score of 4.0–6.9 Low : vulnerabilities with a CVSS base score of 0.0–3.9 Entries may include additional information provided by organizations and efforts sponsored by CISA. This information may include identifying information, values, definitions, and related links.
See 11 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:Low
User Interaction:None
Scope:Unchanged
Confidentiality:None
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI