CVE-2023-24896

Deeper analysis

CVE-2023-24896 is a spoofing vulnerability affecting Microsoft Dynamics 365 Finance. The issue is tracked under CWE-79 and carries a CVSS 3.1 base score of 5.4, reflecting a network-accessible flaw that requires low attack complexity, low privileges, and some user interaction while producing changed scope with limited confidentiality and integrity impact.

An authenticated attacker with low privileges can exploit the vulnerability over the network by crafting input that triggers spoofing behavior when rendered for another user. Successful exploitation allows the attacker to present falsified content within the affected Dynamics 365 Finance application, potentially leading to limited disclosure or modification of information visible to the targeted user.

Microsoft Security Response Center advisories at the referenced URL describe the official patch and mitigation guidance for the vulnerability.

The associated EPSS score rose materially from a low baseline to a peak of 0.0741 on 2025-01-22 before receding to the current value of 0.0036, indicating that exploitation interest increased after public disclosure.