CVE-2023-36433 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	6.5 MEDIUM	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
microsoft	CNA	6.5 MEDIUM				CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
CVE	ADP	---				---
CISA-ADP	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 82%

Vendor	Product	Version
microsoft	dynamics_365	9.0 ≤ 𝑥 < 9.0.49.04
microsoft	dynamics_365	9.1 ≤ 𝑥 < 9.1.21.05

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-643 - Improper Neutralization of Data within XPath Expressions ('XPath Injection')
The software uses external input to dynamically construct an XPath expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36433

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36433