Detections
Analytics
Security Updates for Microsoft Dynamics 365 Business Central (September 2024)
critical Nessus Plugin ID 206974
Language:
Synopsis
The Microsoft Dynamics 365 Business Central install is missing a security update.Description
The Microsoft Dynamics 365 Business Central install is missing security updates. It is, therefore, affected by a privilege escalation vulnerability. An authenticated, remote attacker can exploit this to gain privileged or administrator access to the system.Note that Nessus has not attempted to exploit this issue but has instead relied only on the application's self-reported version number.
Solution
Update Microsoft Dynamics 365 Business Central to 22.16 for 2023 Release Wave 1, 23.10 for 2023 Release Wave 2, 24.4 for 2024 Release Wave 1, or later.See Also
http://support.microsoft.com/kb/5042528
Plugin Details
Severity: Critical
ID: 206974
File Name: smb_nt_ms24_sep_microsoft_dynamics_365_bc.nasl
Version: 1.4
Type: local
Agent: windows
Family: Windows : Microsoft Bulletins
Published: 9/11/2024
Updated: 9/18/2024
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 7.4
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2024-38225
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:microsoft:dynamics_365
Required KB Items: installed_sw/Microsoft Dynamics 365 Business Central Server
Exploit Ease: No known exploits are available
Patch Publication Date: 9/10/2024
Vulnerability Publication Date: 9/10/2024
Reference Information
CVE: CVE-2024-38225