Dataverse
CVE-2024-38139
HIGH
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
Improper authentication in Microsoft Dataverse allows an authorized attacker to elevate privileges over a network.
AnalysisAI
Improper authentication in Microsoft Dataverse allows an authorized attacker to elevate privileges over a network. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Technical ContextAI
This vulnerability is classified as Improper Authentication (CWE-287), which allows attackers to bypass authentication mechanisms to gain unauthorized access. Improper authentication in Microsoft Dataverse allows an authorized attacker to elevate privileges over a network. Affected products include: Microsoft Dataverse.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Implement multi-factor authentication, enforce strong password policies, use proven authentication frameworks.
Deserialization of untrusted data in Microsoft Dataverse allows an authorized attacker to execute code over a network. R
Improper authentication in Microsoft Dataverse allows an authorized attacker to elevate privileges over a network. Rated
Improper handling of insufficient permissions or privileges in Microsoft Dataverse allows an authorized attacker to elev
Deserialization of untrusted data in Microsoft Dataverse allows an authorized attacker to execute code over a network. R
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today