Main Vulnerability Database Vulnerabilities #VU70212

Input validation error in Dynamics NAV and Microsoft Dynamics 365 Business Central - CVE-2022-41127

Published: December 13, 2022

Vulnerability identifier: #VU70212

CSH Severity: Medium

CVSS v4: 9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H]

CVE-ID: CVE-2022-41127

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in the Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises). A remote user can pass specially crafted input to the application and execute arbitrary code on the target system.

Affected software

Dynamics NAV
Microsoft Dynamics 365 Business Central

How to mitigate CVE-2022-41127

Install updates from vendor's website.

External References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41127

Related Security Bulletins