Vulnerabilites related to microsoft - dynamics_365_business_central_2023
CVE-2025-29821 (GCVE-0-2025-29821)
Vulnerability from cvelistv5
Published
2025-04-08 17:23
Modified
2025-06-04 17:52
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
CWE
  • CWE-20 - Improper Input Validation
Summary
Improper input validation in Dynamics Business Central allows an authorized attacker to disclose information locally.
References
Impacted products
Vendor Product Version
Microsoft Microsoft Dynamics 365 Business Central 2024 Wave 1 2024 Version: 24.0   < 24.12.32447.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-29821",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-08T20:05:23.735248Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-08T20:23:05.669Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Microsoft Dynamics 365 Business Central 2024 Wave 1 2024",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "24.12.32447.0",
              "status": "affected",
              "version": "24.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Microsoft Dynamics 365 Business Central 2023 Wave 2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "23.18.32409",
              "status": "affected",
              "version": "23.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Microsoft Dynamics 365 Business Central 2024 Wave 2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "25.6.32556",
              "status": "affected",
              "version": "25.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Microsoft Dynamics 365 Business Central 2025 Wave 1",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "26.0.32481",
              "status": "affected",
              "version": "26.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2024_wave_1:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "24.12.32447.0",
                  "versionStartIncluding": "24.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2023_wave_2:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "23.18.32409",
                  "versionStartIncluding": "23.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2024_wave_2:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "25.6.32556",
                  "versionStartIncluding": "25.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2025_wave_1:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "26.0.32481",
                  "versionStartIncluding": "26.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2025-04-08T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Improper input validation in Dynamics Business Central allows an authorized attacker to disclose information locally."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-06-04T17:52:46.215Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Microsoft Dynamics Business Central Information Disclosure Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29821"
        }
      ],
      "title": "Microsoft Dynamics Business Central Information Disclosure Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2025-29821",
    "datePublished": "2025-04-08T17:23:31.840Z",
    "dateReserved": "2025-03-11T22:56:43.943Z",
    "dateUpdated": "2025-06-04T17:52:46.215Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Vulnerability from fkie_nvd
Published
2025-04-08 18:16
Modified
2025-08-12 16:09
Severity ?
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Summary
Improper input validation in Dynamics Business Central allows an authorized attacker to disclose information locally.
References
secure@microsoft.comhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29821Vendor Advisory
Impacted products
Vendor Product Version
microsoft dynamics_365_business_central_2023 *
microsoft dynamics_365_business_central_2024 *
microsoft dynamics_365_business_central_2024 *
microsoft dynamics_365_business_central_2025 *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2023:*:*:*:*:on-premise:*:*:*",
              "matchCriteriaId": "0285AA8A-CCA9-4BBD-9655-338B2E7AD648",
              "versionEndExcluding": "23.18.32409",
              "versionStartIncluding": "23.1.13812",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2024:*:*:*:*:on-premise:*:*:*",
              "matchCriteriaId": "0404B3E7-5E7F-4926-B390-8D8FD7E5C788",
              "versionEndExcluding": "24.12.32447",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2024:*:*:*:*:on-premise:*:*:*",
              "matchCriteriaId": "B95E007F-0534-4A0B-8A7F-D85C4F199245",
              "versionEndExcluding": "25.6.32556",
              "versionStartIncluding": "25.1.25900",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2025:*:*:*:*:on-premise:*:*:*",
              "matchCriteriaId": "72BE4EFA-54D8-4161-92CA-D0A613439DE4",
              "versionEndExcluding": "26.0.32481",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper input validation in Dynamics Business Central allows an authorized attacker to disclose information locally."
    },
    {
      "lang": "es",
      "value": "La validaci\u00f3n de entrada incorrecta en Dynamics Business Central permite que un atacante autorizado divulgue informaci\u00f3n localmente."
    }
  ],
  "id": "CVE-2025-29821",
  "lastModified": "2025-08-12T16:09:56.373",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6,
        "source": "secure@microsoft.com",
        "type": "Primary"
      }
    ]
  },
  "published": "2025-04-08T18:16:07.867",
  "references": [
    {
      "source": "secure@microsoft.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29821"
    }
  ],
  "sourceIdentifier": "secure@microsoft.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "secure@microsoft.com",
      "type": "Primary"
    }
  ]
}