{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "Marco Niederberger with \u003ca href=\"https://www.logico.ch/\"\u003eLogico Solutions AG\u003c/a\u003e"
        ]
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.microsoft.com/en-us/msrc/security-update-severity-rating-system",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      },
      {
        "category": "general",
        "text": "Required. The vulnerability documented by this CVE requires customer action to resolve.",
        "title": "Customer Action"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2024-21380 Microsoft Dynamics Business Central/NAV Information Disclosure Vulnerability - HTML",
        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21380"
      },
      {
        "category": "self",
        "summary": "CVE-2024-21380 Microsoft Dynamics Business Central/NAV Information Disclosure Vulnerability - CSAF",
        "url": "https://msrc.microsoft.com/csaf/advisories/2024/msrc_cve-2024-21380.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Exploitability Index",
        "url": "https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "Microsoft Dynamics Business Central/NAV Information Disclosure Vulnerability",
    "tracking": {
      "current_release_date": "2024-02-13T08:00:00.000Z",
      "generator": {
        "date": "2025-05-03T01:36:59.824Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2024-21380",
      "initial_release_date": "2024-02-13T08:00:00.000Z",
      "revision_history": [
        {
          "date": "2024-02-13T08:00:00.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003cApplication Build 21.16.63199, Platform Build 21.0",
            "product": {
              "name": "Microsoft Dynamics 365 Business Central 2022 Release Wave 2 \u003cApplication Build 21.16.63199, Platform Build 21.0",
              "product_id": "3"
            }
          },
          {
            "category": "product_version",
            "name": "Application Build 21.16.63199, Platform Build 21.0",
            "product": {
              "name": "Microsoft Dynamics 365 Business Central 2022 Release Wave 2 Application Build 21.16.63199, Platform Build 21.0",
              "product_id": "12109"
            }
          }
        ],
        "category": "product_name",
        "name": "Microsoft Dynamics 365 Business Central 2022 Release Wave 2"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003cApplication Build 22.10.63195, Platform Build 22.0",
            "product": {
              "name": "Microsoft Dynamics 365 Business Central 2023 Release Wave 1 \u003cApplication Build 22.10.63195, Platform Build 22.0",
              "product_id": "2"
            }
          },
          {
            "category": "product_version",
            "name": "Application Build 22.10.63195, Platform Build 22.0",
            "product": {
              "name": "Microsoft Dynamics 365 Business Central 2023 Release Wave 1 Application Build 22.10.63195, Platform Build 22.0",
              "product_id": "12219"
            }
          }
        ],
        "category": "product_name",
        "name": "Microsoft Dynamics 365 Business Central 2023 Release Wave 1"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003cApplication Build 23.4.15715, Platform Build 23.0.",
            "product": {
              "name": "Microsoft Dynamics 365 Business Central 2023 Release Wave 2 \u003cApplication Build 23.4.15715, Platform Build 23.0.",
              "product_id": "1"
            }
          },
          {
            "category": "product_version",
            "name": "Application Build 23.4.15715, Platform Build 23.0.",
            "product": {
              "name": "Microsoft Dynamics 365 Business Central 2023 Release Wave 2 Application Build 23.4.15715, Platform Build 23.0.",
              "product_id": "12294"
            }
          }
        ],
        "category": "product_name",
        "name": "Microsoft Dynamics 365 Business Central 2023 Release Wave 2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-21380",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "notes": [
        {
          "category": "general",
          "text": "Microsoft",
          "title": "Assigning CNA"
        },
        {
          "category": "faq",
          "text": "This vulnerability could lead to the attacker gaining the ability to interact with other tenant\u2019s applications and content.",
          "title": "According to the CVSS metric, successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?"
        },
        {
          "category": "faq",
          "text": "An attacker who successfully exploited this vulnerability could gain high privileges, which include read, write, and delete functionality.",
          "title": "According to the CVSS metrics, successful exploitation of this vulnerability could lead to major loss of confidentiality (C:H), integrity (I:H), and availability (A:H). What does that mean for this vulnerability?"
        },
        {
          "category": "faq",
          "text": "Successful exploitation of this vulnerability requires an attacker to win a race condition.",
          "title": "According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?"
        },
        {
          "category": "faq",
          "text": "An attacker who successfully exploited this vulnerability could craft a payload allowing them to access sensitive user data, which could result in unauthorized access to the victim\u0027s account or compromise of other confidential information.",
          "title": "According to the CVSS metric, successful exploitation of this vulnerability could lead to total loss of confidentiality (C:H)? What does that mean for this vulnerability?"
        },
        {
          "category": "faq",
          "text": "The user would have to click on a specially crafted URL to be compromised by the attacker.",
          "title": "According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?"
        },
        {
          "category": "faq",
          "text": "The attacker must be authenticated to be able to exploit this vulnerability.",
          "title": "According to the CVSS metric, privileges required is low (PR:L).  What does that mean for this vulnerability?"
        }
      ],
      "product_status": {
        "fixed": [
          "12109",
          "12219",
          "12294"
        ],
        "known_affected": [
          "1",
          "2",
          "3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-21380 Microsoft Dynamics Business Central/NAV Information Disclosure Vulnerability - HTML",
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21380"
        },
        {
          "category": "self",
          "summary": "CVE-2024-21380 Microsoft Dynamics Business Central/NAV Information Disclosure Vulnerability - CSAF",
          "url": "https://msrc.microsoft.com/csaf/advisories/2024/msrc_cve-2024-21380.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-02-13T08:00:00.000Z",
          "details": "Application Build 21.16.63199, Platform Build 21.0:Security Update:http://support.microsoft.com/kb/5035205",
          "product_ids": [
            "3"
          ],
          "url": "http://support.microsoft.com/kb/5035205"
        },
        {
          "category": "vendor_fix",
          "date": "2024-02-13T08:00:00.000Z",
          "details": "Application Build 22.10.63195, Platform Build 22.0:Security Update:http://support.microsoft.com/kb/5035206",
          "product_ids": [
            "2"
          ],
          "url": "http://support.microsoft.com/kb/5035206"
        },
        {
          "category": "vendor_fix",
          "date": "2024-02-13T08:00:00.000Z",
          "details": "Application Build 23.4.15715, Platform Build 23.0.:Security Update:http://support.microsoft.com/kb/5035207",
          "product_ids": [
            "1"
          ],
          "url": "http://support.microsoft.com/kb/5035207"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalsScore": 0.0,
            "exploitCodeMaturity": "UNPROVEN",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "CHANGED",
            "temporalScore": 7.0,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Information Disclosure"
        },
        {
          "category": "exploit_status",
          "details": "Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely"
        }
      ],
      "title": "Microsoft Dynamics Business Central/NAV Information Disclosure Vulnerability"
    }
  ]
}