CVE-2023-24922
Published: 14 March 2023
Summary
CVE-2023-24922 is a medium-severity XPath Injection (CWE-643) vulnerability in Microsoft Dynamics 365. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 6.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Microsoft Dynamics 365 (On-Premises) contains an information disclosure vulnerability tracked as CVE-2023-24922. The flaw is associated with CWE-643 and carries a CVSS 3.1 score of 6.5 reflecting network attack vector, low complexity, low privileges required, and high impact to confidentiality with no impact to integrity or availability.
An authenticated attacker with low privileges can exploit the issue remotely without user interaction to obtain sensitive information from the affected Dynamics 365 deployment. The vulnerability affects on-premises installations of the product and does not require elevated rights or special conditions beyond network reachability.
The Microsoft Security Response Center advisory published for CVE-2023-24922 supplies official mitigation guidance and patch information. The associated EPSS score has remained flat at a peak of 0.1204 with no material upward trajectory observed after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-28910
Vulnerability details
Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.