CVE-2019-1229— Dynamics On-Premise 权限许可和访问控制问题漏洞

Dynamics On-Premise Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in Dynamics On-Premise v9. An attacker who successfully exploited the vulnerability could leverage a customizer privilege within Dynamics to gain control of the Web Role hosting the Dynamics installation. To exploit this vulnerability, an attacker needs to have credentials for a user that has permission to author customized business rules in Dynamics, and persist XAML script in a way that causes it to be interpreted as code. The update addresses the vulnerability by restricting XAML activities to a whitelisted set.

N/A

N/A

Dynamics On-Premise 权限许可和访问控制问题漏洞

Microsoft Dynamics 365是美国微软（Microsoft）公司的一套适用于跨国企业的ERP业务解决方案。该产品包括财务管理、生产管理和商业智能管理等。 Microsoft Dynamics 365 (on-premises) 9.0版本中存在提权漏洞。攻击者可借助Dynamics中自定义程序的特权利用该漏洞控制用于Dynamics安装的Web角色。

N/A

N/A