Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2023-24896 (GCVE-0-2023-24896)
Vulnerability from cvelistv5 – Published: 2023-07-14 17:30 – Updated: 2025-01-01 01:43
VLAI?
EPSS
Title
Dynamics 365 Finance Spoofing Vulnerability
Summary
Dynamics 365 Finance Spoofing Vulnerability
Severity ?
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Microsoft | Dynamics 365 for Finance and Operations |
Affected:
10.0.0 , < 10.0.32
(custom)
|
Date Public ?
2023-06-13 07:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-24896",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-30T18:27:09.851905Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:21:24.726Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T11:11:42.478Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "Dynamics 365 Finance Spoofing Vulnerability",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24896"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"Unknown"
],
"product": "Dynamics 365 for Finance and Operations",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.32",
"status": "affected",
"version": "10.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365:*:*:*:*:*:finance_and_operations:*:*",
"versionEndExcluding": "10.0.32",
"versionStartIncluding": "10.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2023-06-13T07:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Dynamics 365 Finance Spoofing Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-01T01:43:30.467Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Dynamics 365 Finance Spoofing Vulnerability",
"tags": [
"vendor-advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24896"
}
],
"title": "Dynamics 365 Finance Spoofing Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2023-24896",
"datePublished": "2023-07-14T17:30:30.307Z",
"dateReserved": "2023-01-31T20:32:35.471Z",
"dateUpdated": "2025-01-01T01:43:30.467Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2023-24896",
"date": "2026-04-14",
"epss": "0.00361",
"percentile": "0.58222"
},
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:microsoft:dynamics_365:*:*:*:*:*:finance_and_operations:*:*\", \"versionEndExcluding\": \"10.0.32\", \"matchCriteriaId\": \"DC99A17C-1CEF-4BA8-9806-A53ECBAAB794\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"Dynamics 365 Finance Spoofing Vulnerability\"}]",
"id": "CVE-2023-24896",
"lastModified": "2024-11-21T07:48:43.680",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"secure@microsoft.com\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\", \"baseScore\": 5.4, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.3, \"impactScore\": 2.7}]}",
"published": "2023-07-14T18:15:09.477",
"references": "[{\"url\": \"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24896\", \"source\": \"secure@microsoft.com\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24896\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}]",
"sourceIdentifier": "secure@microsoft.com",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"secure@microsoft.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-79\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2023-24896\",\"sourceIdentifier\":\"secure@microsoft.com\",\"published\":\"2023-07-14T18:15:09.477\",\"lastModified\":\"2024-11-21T07:48:43.680\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Dynamics 365 Finance Spoofing Vulnerability\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secure@microsoft.com\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.3,\"impactScore\":2.7}]},\"weaknesses\":[{\"source\":\"secure@microsoft.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:dynamics_365:*:*:*:*:*:finance_and_operations:*:*\",\"versionEndExcluding\":\"10.0.32\",\"matchCriteriaId\":\"DC99A17C-1CEF-4BA8-9806-A53ECBAAB794\"}]}]}],\"references\":[{\"url\":\"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24896\",\"source\":\"secure@microsoft.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24896\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24896\", \"name\": \"Dynamics 365 Finance Spoofing Vulnerability\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T11:11:42.478Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-24896\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-30T18:27:09.851905Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-30T18:27:14.062Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"Dynamics 365 Finance Spoofing Vulnerability\", \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 5.4, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C\"}, \"scenarios\": [{\"lang\": \"en-US\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Microsoft\", \"product\": \"Dynamics 365 for Finance and Operations\", \"versions\": [{\"status\": \"affected\", \"version\": \"10.0.0\", \"lessThan\": \"10.0.32\", \"versionType\": \"custom\"}], \"platforms\": [\"Unknown\"]}], \"datePublic\": \"2023-06-13T07:00:00.000Z\", \"references\": [{\"url\": \"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24896\", \"name\": \"Dynamics 365 Finance Spoofing Vulnerability\", \"tags\": [\"vendor-advisory\"]}], \"descriptions\": [{\"lang\": \"en-US\", \"value\": \"Dynamics 365 Finance Spoofing Vulnerability\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en-US\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:microsoft:dynamics_365:*:*:*:*:*:finance_and_operations:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"10.0.32\", \"versionStartIncluding\": \"10.0.0\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"f38d906d-7342-40ea-92c1-6c4a2c6478c8\", \"shortName\": \"microsoft\", \"dateUpdated\": \"2025-01-01T01:43:30.467Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2023-24896\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-01-01T01:43:30.467Z\", \"dateReserved\": \"2023-01-31T20:32:35.471Z\", \"assignerOrgId\": \"f38d906d-7342-40ea-92c1-6c4a2c6478c8\", \"datePublished\": \"2023-07-14T17:30:30.307Z\", \"assignerShortName\": \"microsoft\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
MSRC_CVE-2023-24896
Vulnerability from csaf_microsoft - Published: 2023-06-13 07:00 - Updated: 2023-07-11 07:00Summary
Dynamics 365 Finance Spoofing Vulnerability
Severity
Important
Notes
Additional Resources: To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle
Disclaimer: The information provided in the Microsoft Knowledge Base is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
Customer Action: Required. The vulnerability documented by this CVE requires customer action to resolve.
CWE-79
- Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vendor Fix
10.0.32:Security Update:https://learn.microsoft.com/en-us/dynamics365/finance/get-started/whats-new-changed-10-0-32
https://learn.microsoft.com/en-us/dynamics365/fin…
References
Acknowledgments
<a href="https://www.facebook.com/khalidamin51/">Khalid Amin</a> with <a href="https://cyshield.com/">Cyshield</a>
{
"document": {
"acknowledgments": [
{
"names": [
"\u003ca href=\"https://www.facebook.com/khalidamin51/\"\u003eKhalid Amin\u003c/a\u003e with \u003ca href=\"https://cyshield.com/\"\u003eCyshield\u003c/a\u003e"
]
}
],
"aggregate_severity": {
"namespace": "https://www.microsoft.com/en-us/msrc/security-update-severity-rating-system",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Public",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en-US",
"notes": [
{
"category": "general",
"text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
"title": "Disclaimer"
},
{
"category": "general",
"text": "Required. The vulnerability documented by this CVE requires customer action to resolve.",
"title": "Customer Action"
}
],
"publisher": {
"category": "vendor",
"contact_details": "secure@microsoft.com",
"name": "Microsoft Security Response Center",
"namespace": "https://msrc.microsoft.com"
},
"references": [
{
"category": "self",
"summary": "CVE-2023-24896 Dynamics 365 Finance Spoofing Vulnerability - HTML",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24896"
},
{
"category": "self",
"summary": "CVE-2023-24896 Dynamics 365 Finance Spoofing Vulnerability - CSAF",
"url": "https://msrc.microsoft.com/csaf/2023/msrc_cve-2023-24896.json"
},
{
"category": "external",
"summary": "Microsoft Exploitability Index",
"url": "https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1"
},
{
"category": "external",
"summary": "Microsoft Support Lifecycle",
"url": "https://support.microsoft.com/lifecycle"
},
{
"category": "external",
"summary": "Common Vulnerability Scoring System",
"url": "https://www.first.org/cvss"
}
],
"title": "Dynamics 365 Finance Spoofing Vulnerability",
"tracking": {
"current_release_date": "2023-07-11T07:00:00.000Z",
"generator": {
"date": "2025-01-01T01:43:29.836Z",
"engine": {
"name": "MSRC Generator",
"version": "1.0"
}
},
"id": "msrc_CVE-2023-24896",
"initial_release_date": "2023-06-13T07:00:00.000Z",
"revision_history": [
{
"date": "2023-06-13T07:00:00.000Z",
"legacy_version": "1",
"number": "1",
"summary": "Information published."
},
{
"date": "2023-07-11T07:00:00.000Z",
"legacy_version": "2",
"number": "2",
"summary": "In the Security Updates table, added Download and Article links for Dynamics 365 Finance/Operations. Customers running Dynamics 365 Finance and Operations should install the updates to be protected from this vulnerability."
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c10.0.32",
"product": {
"name": "Dynamics 365 for Finance and Operations \u003c10.0.32",
"product_id": "1"
}
},
{
"category": "product_version",
"name": "10.0.32",
"product": {
"name": "Dynamics 365 for Finance and Operations 10.0.32",
"product_id": "11786"
}
}
],
"category": "product_name",
"name": "Dynamics 365 for Finance and Operations"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2023-24896",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"notes": [
{
"category": "general",
"text": "Microsoft",
"title": "Assigning CNA"
},
{
"category": "faq",
"text": "A user could be tricked into entering credentials or responding to a pop up after opening a specially crafted file or clicking on a link, typically by way of an enticement in an email or URL.",
"title": "According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?"
},
{
"category": "faq",
"text": "Limited information from the victim\u0027s browser associated with the vulnerable URL can be sent to the attacker by the malicious code.",
"title": "According to the CVSS metric, successful exploitation of this vulnerability could lead to some loss of confidentiality (C:L)? What does that mean for this vulnerability?"
},
{
"category": "faq",
"text": "The user would need to access the URL of the malicious website, which could spoof the content of a legitimate website, and then click a popup displayed on that site.",
"title": "According to the CVSS metric, successful exploitation of this vulnerability could lead to some loss of integrity (I:L)? What does that mean for this vulnerability?"
},
{
"category": "faq",
"text": "Any authenticated attacker could trigger this vulnerability. It does not require admin or other elevated privileges.",
"title": "According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?"
}
],
"product_status": {
"fixed": [
"11786"
],
"known_affected": [
"1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-24896 Dynamics 365 Finance Spoofing Vulnerability - HTML",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24896"
},
{
"category": "self",
"summary": "CVE-2023-24896 Dynamics 365 Finance Spoofing Vulnerability - CSAF",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24896"
}
],
"remediations": [
{
"category": "vendor_fix",
"date": "2023-06-13T07:00:00.000Z",
"details": "10.0.32:Security Update:https://learn.microsoft.com/en-us/dynamics365/finance/get-started/whats-new-changed-10-0-32",
"product_ids": [
"1"
],
"url": "https://learn.microsoft.com/en-us/dynamics365/finance/get-started/whats-new-changed-10-0-32"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"environmentalsScore": 0.0,
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "CHANGED",
"temporalScore": 4.7,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1"
]
}
],
"threats": [
{
"category": "impact",
"details": "Spoofing"
},
{
"category": "exploit_status",
"details": "Exploited:No;Latest Software Release:Exploitation Less Likely"
}
],
"title": "Dynamics 365 Finance Spoofing Vulnerability"
}
]
}
CERTFR-2023-AVI-0465
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été corrigées dans les produits Microsoft. Elles permettent à un attaquant de provoquer une usurpation d'identité, une atteinte à la confidentialité des données, un déni de service, une exécution de code à distance et une élévation de privilèges.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Microsoft | N/A | Microsoft Exchange Server 2019 Cumulative Update 13 | ||
| Microsoft | N/A | NuGet 6.4.1 | ||
| Microsoft | N/A | Microsoft Power Apps | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.0 | ||
| Microsoft | N/A | Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.2 | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.5 | ||
| Microsoft | N/A | Dynamics 365 pour Finance and Operations | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.6 | ||
| Microsoft | N/A | NuGet 6.2.3 | ||
| Microsoft | N/A | YARP 2.0 | ||
| Microsoft | N/A | Microsoft Exchange Server 2016 Cumulative Update 23 | ||
| Microsoft | N/A | Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) | ||
| Microsoft | N/A | NuGet 6.5.0 | ||
| Microsoft | N/A | Visual Studio Code | ||
| Microsoft | N/A | Microsoft Visual Studio 2013 Update 5 | ||
| Microsoft | N/A | Microsoft 365 Apps pour Enterprise pour systèmes 32 bits | ||
| Microsoft | N/A | Microsoft 365 Apps pour Enterprise pour 64 bits Systems | ||
| Microsoft | N/A | NuGet 6.6.0 | ||
| Microsoft | N/A | NuGet 6.3.2 | ||
| Microsoft | N/A | Microsoft Visual Studio 2015 Update 3 | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.4 | ||
| Microsoft | N/A | NuGet 6.0.4 | ||
| Microsoft | N/A | Microsoft Exchange Server 2019 Cumulative Update 12 | ||
| Microsoft | N/A | Sysinternals Suite |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Microsoft Exchange Server 2019 Cumulative Update 13",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "NuGet 6.4.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Power Apps",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Dynamics 365 pour Finance and Operations",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.6",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "NuGet 6.2.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "YARP 2.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2016 Cumulative Update 23",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "NuGet 6.5.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Visual Studio Code",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2013 Update 5",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft 365 Apps pour Enterprise pour syst\u00e8mes 32 bits",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft 365 Apps pour Enterprise pour 64 bits Systems",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "NuGet 6.6.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "NuGet 6.3.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2015 Update 3",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "NuGet 6.0.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2019 Cumulative Update 12",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Sysinternals Suite",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-24895",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24895"
},
{
"name": "CVE-2023-27910",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27910"
},
{
"name": "CVE-2023-33144",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33144"
},
{
"name": "CVE-2023-33135",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33135"
},
{
"name": "CVE-2023-25815",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25815"
},
{
"name": "CVE-2023-33131",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33131"
},
{
"name": "CVE-2023-24897",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24897"
},
{
"name": "CVE-2023-24936",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24936"
},
{
"name": "CVE-2023-29011",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29011"
},
{
"name": "CVE-2023-29012",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29012"
},
{
"name": "CVE-2023-29007",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29007"
},
{
"name": "CVE-2023-33128",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33128"
},
{
"name": "CVE-2023-33141",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33141"
},
{
"name": "CVE-2023-32031",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-32031"
},
{
"name": "CVE-2023-29337",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29337"
},
{
"name": "CVE-2023-33133",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33133"
},
{
"name": "CVE-2023-27911",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27911"
},
{
"name": "CVE-2023-33146",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33146"
},
{
"name": "CVE-2023-32032",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-32032"
},
{
"name": "CVE-2023-27909",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27909"
},
{
"name": "CVE-2023-33139",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33139"
},
{
"name": "CVE-2023-29331",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29331"
},
{
"name": "CVE-2023-25652",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25652"
},
{
"name": "CVE-2023-29353",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29353"
},
{
"name": "CVE-2023-28310",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28310"
},
{
"name": "CVE-2023-32029",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-32029"
},
{
"name": "CVE-2023-24896",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24896"
},
{
"name": "CVE-2023-32024",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-32024"
},
{
"name": "CVE-2023-33126",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33126"
}
],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-24895 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24895"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28310 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28310"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-32029 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32029"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-29331 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29331"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-29011 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29011"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-27911 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-27911"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-33131 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33131"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-29353 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29353"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-24896 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24896"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-32032 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32032"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-33135 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33135"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-29012 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29012"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-33139 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33139"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-27910 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-27910"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-24897 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24897"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-29337 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29337"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-33146 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33146"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-25815 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-25815"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-33128 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33128"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-33126 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33126"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-32024 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32024"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-33141 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33141"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-29007 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29007"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-25652 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-25652"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-27909 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-27909"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-33144 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33144"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-33133 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33133"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-24936 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24936"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-32031 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32031"
}
],
"reference": "CERTFR-2023-AVI-0465",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-06-14T00:00:00.000000"
}
],
"risks": [
{
"description": "Usurpation d\u0027identit\u00e9"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eles produits Microsoft\u003c/span\u003e. Elles permettent \u00e0 un\nattaquant de provoquer une usurpation d\u0027identit\u00e9, une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es, un d\u00e9ni de service, une ex\u00e9cution de code \u00e0\ndistance et une \u00e9l\u00e9vation de privil\u00e8ges.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Microsoft",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/"
}
]
}
CERTFR-2023-AVI-0465
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été corrigées dans les produits Microsoft. Elles permettent à un attaquant de provoquer une usurpation d'identité, une atteinte à la confidentialité des données, un déni de service, une exécution de code à distance et une élévation de privilèges.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Microsoft | N/A | Microsoft Exchange Server 2019 Cumulative Update 13 | ||
| Microsoft | N/A | NuGet 6.4.1 | ||
| Microsoft | N/A | Microsoft Power Apps | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.0 | ||
| Microsoft | N/A | Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.2 | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.5 | ||
| Microsoft | N/A | Dynamics 365 pour Finance and Operations | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.6 | ||
| Microsoft | N/A | NuGet 6.2.3 | ||
| Microsoft | N/A | YARP 2.0 | ||
| Microsoft | N/A | Microsoft Exchange Server 2016 Cumulative Update 23 | ||
| Microsoft | N/A | Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) | ||
| Microsoft | N/A | NuGet 6.5.0 | ||
| Microsoft | N/A | Visual Studio Code | ||
| Microsoft | N/A | Microsoft Visual Studio 2013 Update 5 | ||
| Microsoft | N/A | Microsoft 365 Apps pour Enterprise pour systèmes 32 bits | ||
| Microsoft | N/A | Microsoft 365 Apps pour Enterprise pour 64 bits Systems | ||
| Microsoft | N/A | NuGet 6.6.0 | ||
| Microsoft | N/A | NuGet 6.3.2 | ||
| Microsoft | N/A | Microsoft Visual Studio 2015 Update 3 | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.4 | ||
| Microsoft | N/A | NuGet 6.0.4 | ||
| Microsoft | N/A | Microsoft Exchange Server 2019 Cumulative Update 12 | ||
| Microsoft | N/A | Sysinternals Suite |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Microsoft Exchange Server 2019 Cumulative Update 13",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "NuGet 6.4.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Power Apps",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Dynamics 365 pour Finance and Operations",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.6",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "NuGet 6.2.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "YARP 2.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2016 Cumulative Update 23",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "NuGet 6.5.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Visual Studio Code",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2013 Update 5",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft 365 Apps pour Enterprise pour syst\u00e8mes 32 bits",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft 365 Apps pour Enterprise pour 64 bits Systems",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "NuGet 6.6.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "NuGet 6.3.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2015 Update 3",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "NuGet 6.0.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2019 Cumulative Update 12",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Sysinternals Suite",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-24895",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24895"
},
{
"name": "CVE-2023-27910",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27910"
},
{
"name": "CVE-2023-33144",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33144"
},
{
"name": "CVE-2023-33135",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33135"
},
{
"name": "CVE-2023-25815",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25815"
},
{
"name": "CVE-2023-33131",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33131"
},
{
"name": "CVE-2023-24897",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24897"
},
{
"name": "CVE-2023-24936",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24936"
},
{
"name": "CVE-2023-29011",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29011"
},
{
"name": "CVE-2023-29012",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29012"
},
{
"name": "CVE-2023-29007",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29007"
},
{
"name": "CVE-2023-33128",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33128"
},
{
"name": "CVE-2023-33141",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33141"
},
{
"name": "CVE-2023-32031",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-32031"
},
{
"name": "CVE-2023-29337",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29337"
},
{
"name": "CVE-2023-33133",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33133"
},
{
"name": "CVE-2023-27911",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27911"
},
{
"name": "CVE-2023-33146",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33146"
},
{
"name": "CVE-2023-32032",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-32032"
},
{
"name": "CVE-2023-27909",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27909"
},
{
"name": "CVE-2023-33139",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33139"
},
{
"name": "CVE-2023-29331",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29331"
},
{
"name": "CVE-2023-25652",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25652"
},
{
"name": "CVE-2023-29353",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29353"
},
{
"name": "CVE-2023-28310",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28310"
},
{
"name": "CVE-2023-32029",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-32029"
},
{
"name": "CVE-2023-24896",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24896"
},
{
"name": "CVE-2023-32024",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-32024"
},
{
"name": "CVE-2023-33126",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-33126"
}
],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-24895 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24895"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-28310 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28310"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-32029 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32029"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-29331 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29331"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-29011 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29011"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-27911 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-27911"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-33131 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33131"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-29353 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29353"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-24896 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24896"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-32032 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32032"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-33135 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33135"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-29012 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29012"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-33139 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33139"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-27910 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-27910"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-24897 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24897"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-29337 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29337"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-33146 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33146"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-25815 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-25815"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-33128 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33128"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-33126 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33126"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-32024 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32024"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-33141 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33141"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-29007 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29007"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-25652 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-25652"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-27909 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-27909"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-33144 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33144"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-33133 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33133"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-24936 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24936"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-32031 du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32031"
}
],
"reference": "CERTFR-2023-AVI-0465",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-06-14T00:00:00.000000"
}
],
"risks": [
{
"description": "Usurpation d\u0027identit\u00e9"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eles produits Microsoft\u003c/span\u003e. Elles permettent \u00e0 un\nattaquant de provoquer une usurpation d\u0027identit\u00e9, une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es, un d\u00e9ni de service, une ex\u00e9cution de code \u00e0\ndistance et une \u00e9l\u00e9vation de privil\u00e8ges.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Microsoft",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 13 juin 2023",
"url": "https://msrc.microsoft.com/update-guide/"
}
]
}
WID-SEC-W-2023-1444
Vulnerability from csaf_certbund - Published: 2023-06-13 22:00 - Updated: 2023-06-13 22:00Summary
Microsoft Dynamics: Schwachstelle ermöglicht Manipulation von Dateien und Offenlegung von Informationen
Severity
Mittel
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung: Microsoft bietet in der Apps-Produktfamilie zahlreiche Anwendungen für mobile Endgeräte an.
Microsoft Dynamics 365 ist eine All-in-One-Unternehmensmanagementlösung.
Angriff: Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Microsoft Apps und Microsoft Dynamics 365 ausnutzen, um Dateien zu manipulieren und Informationen offenzulegen.
Betroffene Betriebssysteme: - Windows
Es existieren mehrere Schwachstellen in Microsoft Apps und Microsoft Dynamics 365. Die Fehler bestehen aufgrund eines Spoofing-Problems. Ein entfernter, authentisierter Angreifer kann diese Schwachstelle ausnutzen, um vertrauliche Informationen offenzulegen und Daten zu manipulieren. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.
Es existieren mehrere Schwachstellen in Microsoft Apps und Microsoft Dynamics 365. Die Fehler bestehen aufgrund eines Spoofing-Problems. Ein entfernter, authentisierter Angreifer kann diese Schwachstelle ausnutzen, um vertrauliche Informationen offenzulegen und Daten zu manipulieren. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.
References
{
"document": {
"aggregate_severity": {
"text": "mittel"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Microsoft bietet in der Apps-Produktfamilie zahlreiche Anwendungen f\u00fcr mobile Endger\u00e4te an.\r\nMicrosoft Dynamics 365 ist eine All-in-One-Unternehmensmanagementl\u00f6sung.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Microsoft Apps und Microsoft Dynamics 365 ausnutzen, um Dateien zu manipulieren und Informationen offenzulegen.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Windows",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2023-1444 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-1444.json"
},
{
"category": "self",
"summary": "WID-SEC-2023-1444 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-1444"
},
{
"category": "external",
"summary": "Microsoft Leitfaden f\u00fcr Sicherheitsupdates vom 2023-06-13",
"url": "https://msrc.microsoft.com/update-guide"
}
],
"source_lang": "en-US",
"title": "Microsoft Dynamics: Schwachstelle erm\u00f6glicht Manipulation von Dateien und Offenlegung von Informationen",
"tracking": {
"current_release_date": "2023-06-13T22:00:00.000+00:00",
"generator": {
"date": "2024-08-15T17:52:24.253+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.3.5"
}
},
"id": "WID-SEC-W-2023-1444",
"initial_release_date": "2023-06-13T22:00:00.000+00:00",
"revision_history": [
{
"date": "2023-06-13T22:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Microsoft Apps Power Apps",
"product": {
"name": "Microsoft Apps Power Apps",
"product_id": "T028107",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:apps:power_apps"
}
}
},
{
"category": "product_name",
"name": "Microsoft Dynamics 365 for Finance and Operations",
"product": {
"name": "Microsoft Dynamics 365 for Finance and Operations",
"product_id": "T028108",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:dynamics_365:for_finance_and_operations"
}
}
}
],
"category": "vendor",
"name": "Microsoft"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2023-32024",
"notes": [
{
"category": "description",
"text": "Es existieren mehrere Schwachstellen in Microsoft Apps und Microsoft Dynamics 365. Die Fehler bestehen aufgrund eines Spoofing-Problems. Ein entfernter, authentisierter Angreifer kann diese Schwachstelle ausnutzen, um vertrauliche Informationen offenzulegen und Daten zu manipulieren. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion."
}
],
"product_status": {
"known_affected": [
"T028107",
"T028108"
]
},
"release_date": "2023-06-13T22:00:00.000+00:00",
"title": "CVE-2023-32024"
},
{
"cve": "CVE-2023-24896",
"notes": [
{
"category": "description",
"text": "Es existieren mehrere Schwachstellen in Microsoft Apps und Microsoft Dynamics 365. Die Fehler bestehen aufgrund eines Spoofing-Problems. Ein entfernter, authentisierter Angreifer kann diese Schwachstelle ausnutzen, um vertrauliche Informationen offenzulegen und Daten zu manipulieren. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion."
}
],
"product_status": {
"known_affected": [
"T028107",
"T028108"
]
},
"release_date": "2023-06-13T22:00:00.000+00:00",
"title": "CVE-2023-24896"
}
]
}
BDU:2023-03232
Vulnerability from fstec - Published: 13.06.2023
VLAI Severity ?
Title
Уязвимость программного средства для планирования ресурсов Microsoft Dynamics 365 for Finance and Operations, связанная с ошибками представления информации пользовательским интерфейсом, позволяющая нарушителю проводить спуфинг-атаки
Description
Уязвимость программного средства для планирования ресурсов Microsoft Dynamics 365 for Finance and Operations связана с ошибками представления информации пользовательским интерфейсом. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, проводить спуфинг-атаки
Severity ?
Vendor
Microsoft Corp
Software Name
Microsoft Dynamics 365 for Finance and Operations
Software Version
- (Microsoft Dynamics 365 for Finance and Operations)
Possible Mitigations
Использование рекомендаций производителя:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24896
Reference
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24896
https://www.cybersecurity-help.cz/vdb/SB2023061411
https://vuldb.com/?id.231372
CWE
CWE-451
{
"CVSS 2.0": "AV:N/AC:L/Au:S/C:P/I:P/A:N",
"CVSS 3.0": "AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"CVSS 4.0": null,
"remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
"remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
"\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Microsoft Corp",
"\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "- (Microsoft Dynamics 365 for Finance and Operations)",
"\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24896",
"\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "13.06.2023",
"\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "19.06.2023",
"\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "19.06.2023",
"\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2023-03232",
"\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2023-24896",
"\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
"\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
"\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Microsoft Dynamics 365 for Finance and Operations",
"\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
"\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0434\u043b\u044f \u043f\u043b\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 Microsoft Dynamics 365 for Finance and Operations, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u043c \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u043e\u043c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442\u044c \u0441\u043f\u0443\u0444\u0438\u043d\u0433-\u0430\u0442\u0430\u043a\u0438",
"\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
"\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "UI \u041b\u043e\u0436\u043d\u043e\u0435 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u043c \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u043e\u043c. (CWE-451)",
"\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0434\u043b\u044f \u043f\u043b\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 Microsoft Dynamics 365 for Finance and Operations \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u043c \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u043e\u043c. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442\u044c \u0441\u043f\u0443\u0444\u0438\u043d\u0433-\u0430\u0442\u0430\u043a\u0438",
"\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
"\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
"\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
"\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
"\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
"\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041f\u043e\u0434\u043c\u0435\u043d\u0430 \u043f\u0440\u0438 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0438",
"\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24896\nhttps://www.cybersecurity-help.cz/vdb/SB2023061411\nhttps://vuldb.com/?id.231372",
"\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
"\u0422\u0438\u043f \u041f\u041e": "\u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
"\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-451",
"\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 5,5)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 5,4)"
}
GHSA-26VJ-JQR4-V7FV
Vulnerability from github – Published: 2023-07-14 18:31 – Updated: 2024-04-04 06:08
VLAI?
Details
Dynamics 365 Finance Spoofing Vulnerability
Severity ?
5.4 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-24896"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-14T18:15:09Z",
"severity": "MODERATE"
},
"details": "Dynamics 365 Finance Spoofing Vulnerability",
"id": "GHSA-26vj-jqr4-v7fv",
"modified": "2024-04-04T06:08:33Z",
"published": "2023-07-14T18:31:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24896"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24896"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
FKIE_CVE-2023-24896
Vulnerability from fkie_nvd - Published: 2023-07-14 18:15 - Updated: 2024-11-21 07:48
Severity ?
Summary
Dynamics 365 Finance Spoofing Vulnerability
References
| URL | Tags | ||
|---|---|---|---|
| secure@microsoft.com | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24896 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24896 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| microsoft | dynamics_365 | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:dynamics_365:*:*:*:*:*:finance_and_operations:*:*",
"matchCriteriaId": "DC99A17C-1CEF-4BA8-9806-A53ECBAAB794",
"versionEndExcluding": "10.0.32",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Dynamics 365 Finance Spoofing Vulnerability"
}
],
"id": "CVE-2023-24896",
"lastModified": "2024-11-21T07:48:43.680",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "secure@microsoft.com",
"type": "Secondary"
}
]
},
"published": "2023-07-14T18:15:09.477",
"references": [
{
"source": "secure@microsoft.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24896"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24896"
}
],
"sourceIdentifier": "secure@microsoft.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "secure@microsoft.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
GSD-2023-24896
Vulnerability from gsd - Updated: 2023-12-13 01:20{
"GSD": {
"alias": "CVE-2023-24896",
"id": "GSD-2023-24896"
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2023-24896"
],
"details": "Dynamics 365 Finance Spoofing Vulnerability",
"id": "GSD-2023-24896",
"modified": "2023-12-13T01:20:57.609163Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "secure@microsoft.com",
"ID": "CVE-2023-24896",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Dynamics 365 for Finance and Operations",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "10.0.0",
"version_value": "10.0.32"
}
]
}
}
]
},
"vendor_name": "Microsoft"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Dynamics 365 Finance Spoofing Vulnerability"
}
]
},
"impact": {
"cvss": [
{
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C",
"version": "3.1"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Spoofing"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24896",
"refsource": "MISC",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24896"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:microsoft:dynamics_365:*:*:*:*:*:finance_and_operations:*:*",
"cpe_name": [],
"versionEndExcluding": "10.0.32",
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "secure@microsoft.com",
"ID": "CVE-2023-24896"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "Dynamics 365 Finance Spoofing Vulnerability"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24896",
"refsource": "MISC",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24896"
}
]
}
},
"impact": {
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7
}
},
"lastModifiedDate": "2023-07-27T13:28Z",
"publishedDate": "2023-07-14T18:15Z"
}
}
}
Loading…
Show additional events:
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…