Vulnerability Description
An elevation of privilege vulnerability exists in Dynamics On-Premise v9. An attacker who successfully exploited the vulnerability could leverage a customizer privilege within Dynamics to gain control of the Web Role hosting the Dynamics installation. To exploit this vulnerability, an attacker needs to have credentials for a user that has permission to author customized business rules in Dynamics, and persist XAML script in a way that causes it to be interpreted as code. The update addresses the vulnerability by restricting XAML activities to a whitelisted set.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Dynamics 365 | 9.0 |
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1229PatchVendor Advisory
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1229PatchVendor Advisory
FAQ
What is CVE-2019-1229?
CVE-2019-1229 is a vulnerability with a CVSS score of 8.8 (HIGH). An elevation of privilege vulnerability exists in Dynamics On-Premise v9. An attacker who successfully exploited the vulnerability could leverage a customizer privilege within Dynamics to gain control...
How severe is CVE-2019-1229?
CVE-2019-1229 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-1229?
Check the references section above for vendor advisories and patch information. Affected products include: Microsoft Dynamics 365.