PT-2019-12735 · Microsoft · Dynamics On-Premise

Published 2019-08-14 · Updated 2024-05-29 · CVE-2019-1229

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dynamics On-Premise version 9

Description An elevation of privilege issue exists, allowing an attacker to gain control of the Web Role hosting the Dynamics installation by leveraging a customizer privilege within Dynamics. To exploit this, an attacker needs credentials for a user with permission to author customized business rules in Dynamics and must persist XAML script in a way that causes it to be interpreted as code.

Recommendations For Dynamics On-Premise version 9, update to a version that restricts XAML activities to a whitelisted set to address the vulnerability.

Fix

Related Identifiers

CVE-2019-1229

Affected Products

Dynamics On-Premise

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-1229 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1229 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-1229 · Vendor Advisory