CVE-2024-30061: 
Microsoft Dynamics 365 vulnerability analysis and mitigation

Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability (CVE-2024-30061) affects Microsoft Dynamics CRM (on-premises) version 9.1. The vulnerability was disclosed in July 2024 and is related to improper authorization in the system. This security issue has been assigned a CVSS 3.1 base score of 7.3 HIGH (NVD, Qualys).

The vulnerability stems from improper authorization (CWE-285) in Microsoft Dynamics 365's on-premises deployment. The technical issue allows potential attackers to access sensitive information by monitoring domain network traffic and user-generated network traffic. The vulnerability has been assigned a CVSS vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N (NVD).

Successful exploitation of this vulnerability could allow an unauthenticated, remote attacker to gain access to data stored in the underlying datasets in Dataverse, potentially including Personal Identifiable Information (Qualys).

The vulnerability requires low attack complexity and limited privileges for exploitation, though user interaction is required as indicated by the CVSS metrics. There are currently no reports of this vulnerability being exploited in the wild (NVD).

Microsoft has released security updates to address this vulnerability. Organizations running Microsoft Dynamics CRM (on-premises) version 9.1 should apply the available patches as soon as possible (Qualys).