CVE-2023-36429
10.10.2023, 18:15
Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
| Vendor | Product | Version |
|---|---|---|
| microsoft | dynamics_365 | 9.0 ≤ 𝑥 < 9.0.50.03 |
| microsoft | dynamics_365 | 9.1 ≤ 𝑥 < 9.1.22.04 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-643 - Improper Neutralization of Data within XPath Expressions ('XPath Injection')The software uses external input to dynamically construct an XPath expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query.
- CWE-668 - Exposure of Resource to Wrong SphereThe product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.