PT-2024-5725 · Microsoft · Dynamics Crm+1

Published 2024-08-06 · Updated 2024-09-05 · CVE-2024-38166

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:C/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Dynamics CRM (affected versions not specified) Microsoft Dynamics 365 (affected versions not specified)

Description The issue exists due to inadequate protection of the web page structure in Microsoft Dynamics CRM, allowing for improper neutralization of input during web page generation. This can be exploited by an unauthenticated attacker to conduct spoofing attacks over a network by tricking a user into clicking on a link. The exploitation may lead to malicious code execution.

Recommendations For Microsoft Dynamics CRM, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Microsoft Dynamics 365, patch immediately to resolve the issue and monitor for signs of compromise.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-06438

CVE-2024-38166

Affected Products

Dynamics 365

Dynamics Crm

References · 16

• https://bdu.fstec.ru/vul/2024-06438 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-38166 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38166 · Vendor Advisory
• https://t.me/cvenotify/90391 · Telegram Post
• https://threats.kaspersky.com/ru/vulnerability/KLA71413 · Note
• https://t.me/cvenotify/89530 · Telegram Post
• https://vuldb.com/?id.273794 · Note
• https://t.me/cvenotify/90412 · Telegram Post
• https://t.me/cvenotify/90423 · Telegram Post
• https://t.me/cvenotify/89887 · Telegram Post
• https://cvefeed.io/vuln/detail/CVE-2024-38166 · Note
• https://t.me/cvenotify/89842 · Telegram Post
• https://twitter.com/windowsforum/status/1831819839888916853 · Twitter Post
• https://t.me/cvedetector/2646 · Telegram Post
• https://twitter.com/oktsec/status/1823981502746476837 · Twitter Post