Improper Authorization (CWE-285)
Improper authorization in Dynamics 365 Business Central resulted in a vulnerability that allows an authenticated attacker to elevate privileges over a network.
This vulnerability has a high severity with a CVSS v3.1 base score of 8.8. It affects the confidentiality, integrity, and availability of the system, all with high impact. An authenticated attacker with low privileges can exploit this vulnerability over a network without any user interaction. The attack complexity is low, making it relatively easy to exploit. The potential impacts include unauthorized access to sensitive data, modification of system settings or data, and potential disruption of services.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
A patch is available. Microsoft has released an update to address this vulnerability. The patch was added on September 17, 2024, and is available through the Microsoft Security Response Center.
1. Apply the security update provided by Microsoft as soon as possible. 2. Implement the principle of least privilege, ensuring users have only the necessary permissions. 3. Monitor for suspicious activities, especially privilege escalation attempts. 4. Use network segmentation to limit the potential impact of a successful attack. 5. Regularly audit user permissions and access controls in Dynamics 365 Business Central. 6. Keep all Dynamics 365 Business Central installations up to date with the latest security patches.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C
NVD published the first details for CVE-2024-43460
Feedly found the first article mentioning CVE-2024-43460. See article
Feedly estimated the CVSS score as HIGH
EPSS Score was set to: 0.05% (Percentile: 16.8%)
A CVSS base score of 8.8 has been assigned.
EPSS Score was set to: 0.05% (Percentile: 17.5%)