PT-2024-8866 · Microsoft · Dynamics 365 Sales

Published 2024-11-26 · Updated 2025-01-08 · CVE-2024-49053

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Microsoft Dynamics 365 Sales versions prior to 3.24104.15

Description: The issue concerns a spoofing vulnerability in Microsoft Dynamics 365 Sales. This vulnerability may allow a remote attacker to perform a spoofing attack by not taking measures to protect the web page structure.

Recommendations: Update Dynamics 365 Sales apps for Android and iOS to version 3.24104.15 to secure against the issue. As a temporary workaround, consider restricting access to potentially vulnerable web pages until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-10533

CVE-2024-49053

Affected Products

Dynamics 365 Sales

References · 10

• https://cve.org/CVERecord?id=CVE-2024-49053 · Security Note
• https://bdu.fstec.ru/vul/2024-10533 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49053 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-49053 · Security Note
• https://osv.dev/vulnerability/CVE-2024-49053 · Vendor Advisory
• https://twitter.com/Eth1calHackrZ/status/1864825834550301046 · Twitter Post
• https://twitter.com/cyraxsecurity/status/1862727197791805504 · Twitter Post
• https://twitter.com/cyraxsecurity/status/1862727194448986192 · Twitter Post
• https://t.me/cvenotify/106747 · Telegram Post
• https://twitter.com/PSuiteNetwork/status/1862684337470091371 · Twitter Post