CVE-2022-23271

Deeper analysis

CVE-2022-23271 is an elevation-of-privilege vulnerability affecting Microsoft Dynamics GP. The flaw carries a CVSS 3.1 score of 6.5 with a network attack vector, low complexity, and low privileges required, resulting in high impact to confidentiality while leaving integrity and availability untouched.

An authenticated attacker with low-privileged network access can exploit the issue to obtain unauthorized access to sensitive information stored within the Dynamics GP application. No user interaction is needed, and the attack can be performed remotely without elevated credentials.

Microsoft’s Security Response Center advisory, available at the referenced URL, provides official guidance on mitigation and any applicable patches or updates released for the affected product versions.

EPSS for the CVE has remained flat at a peak and current value of 0.0721 since disclosure, indicating no material increase in observed exploitation interest.