CVE-2023-38167
published 2023-08-08CVE-2023-38167: Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
PriorityP339high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
1.40%
72.2th percentile
Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | dynamics_365_business_central | — | — |
| microsoft | microsoft_dynamics_365_business_central_2023_release_wave_1 | >= 22.0.0 < 22.0.59520 | 22.0.59520 |
| msrc | microsoft_dynamics_365_business_central_2023_release_wave_1 | — | — |
CVSS provenance
nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
vendor_msrc7.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-9j64-pxww-55vc: Microsoft Dynamics Business Central Elevation Of Privilege Vulnerability
ghsa_unreviewed·2023-08-08
CVE-2023-38167 [HIGH] CWE-284 GHSA-9j64-pxww-55vc: Microsoft Dynamics Business Central Elevation Of Privilege Vulnerability
Microsoft Dynamics Business Central Elevation Of Privilege Vulnerability
Microsoft
Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
vendor_msrc·2023-08-08·CVSS 7.2
CVE-2023-38167 [HIGH] CWE-284 Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
FAQ: According to the CVSS metric, privileges required is high (PR:H). What privileges does an attacker require to exploit this vulnerability?
Successful exploitation of this vulnerability requires an attacker to already have admin or high privilege access to a security group within the tenant.
FAQ: Is the update for Microsoft Dynamics 365 Business Central 2023 Release Wave 1 listed in this vulnerability currently available?
The security update for Microsoft Dynamics 365 Business Central 2023 Release Wave 1 is not immediately available. The update will be released as soon as possible, and when it is available, customers will be notified via a revision to this CVE information.
August 15. 2023 Update: The security
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-08-08
Published