Microsoft Dataverse Remote Code Execution Vulnerability
CVE-2024-35260 is a remote code execution vulnerability in Microsoft Dataverse (rated Critical, CVSS 8.0). Microsoft fixed it in the service; customers need to do nothing.
1 version
Facts
- Microsoft id
CVE-2024-35260- Products
- Microsoft Dataverse
- Severity
- Critical
- Impact
- Remote Code Execution
- CVSS
- 8.0
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
- Exploited
- No
- Publicly disclosed
- No
- Exploitability
- Exploitation More Likely
- Customer action required
- No
- Release
- 2024-Jun
- Assigned by
- Microsoft
- Weakness
- CWE-426: Untrusted Search Path
- MSRC revision
- 1.0
- Status pages
- Power Apps status
- First captured by us
- (from our first import of this list)
- Microsoft last modified
- Source
- Security updates · open the original at Microsoft
Microsoft's revision notes
- Revision 1.0, 2024-06-27:
Information published.
Microsoft says
An authenticated attacker can exploit an untrusted search path vulnerability in Microsoft Dataverse to execute code over a network.
What Microsoft changed
One version so far. If Microsoft edits it, each change shows here with what was removed and added.
First version we captured ·
The text as we first saw it
Seen by us · Microsoft's timestamp · Microsoft's page
Related changes
Other changes for Power Apps
- Microsoft Dataverse Remote Code Execution Vulnerability
- Microsoft Power Apps Remote Code Execution Vulnerability
- Microsoft Power Apps Desktop Client Spoofing Vulnerability
- PowerApps Desktop Client Remote Code Execution Vulnerability
- Microsoft Dataverse Elevation of Privilege Vulnerability
- Microsoft Dataverse Remote Code Execution Vulnerability
- Microsoft Power Apps Information Disclosure Vulnerability
- Microsoft Dataverse Remote Code Execution Vulnerability