CVE-2022-23272
Published: 09 February 2022
Summary
CVE-2022-23272 is a high-severity an unspecified weakness vulnerability in Microsoft Dynamics Gp. Its CVSS base score is 8.1 (High).
Operationally, ranked in the top 8.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-23272 is an elevation of privilege vulnerability affecting Microsoft Dynamics GP. The flaw carries a CVSS 3.1 base score of 8.1 with the vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, indicating that a network-accessible attacker with low privileges can obtain high impact on confidentiality and integrity without user interaction.
An authenticated user with limited rights can exploit the issue remotely to elevate privileges and access or modify sensitive data within the Dynamics GP environment. The vulnerability does not affect availability.
Microsoft has published guidance and patches for the flaw through its Security Response Center at the listed advisory URL; administrators should apply the recommended updates to eliminate the exposure. The associated EPSS score has remained flat at 0.0721 with no material increase observed since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-28358
Vulnerability details
Microsoft Dynamics GP Elevation Of Privilege Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.