Read the docs
TI-2024-14140 Aliases CVE-2024-21380GHSA-7ffr-7c74-8mp9

Microsoft Dynamics Business Central/NAV Information Disclosure Vulnerability

Priority MEDIUM 40CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from Microsoft.

Summary

Microsoft Dynamics Business Central/NAV Information Disclosure Vulnerability

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01739 77th percentileScored 2026-11-07
Fix Fixed Microsoft Dynamics 365 Business Central 2022 Release Wave 2 (Microsoft): 21.0.63175Microsoft Dynamics 365 Business Central 2023 Release Wave 1 (Microsoft): 22.0.63124+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftMicrosoft Dynamics 365 Business Central 2022 Release Wave 221.0.0 to before 21.0.6317521.0.63175Patch availableCNA
MicrosoftMicrosoft Dynamics 365 Business Central 2023 Release Wave 122.0.0 to before 22.0.6312422.0.63124Patch availableCNA
MicrosoftMicrosoft Dynamics 365 Business Central 2023 Release Wave 223.0.0 to before 23.0.1571223.0.15712Patch availableCNA
  • Microsoft Dynamics 365 Business Central 2022 Release Wave 2 VendorMicrosoft Affected 21.0.0 to before 21.0.63175 Fixed in 21.0.63175 Patch available CNA
  • Microsoft Dynamics 365 Business Central 2023 Release Wave 1 VendorMicrosoft Affected 22.0.0 to before 22.0.63124 Fixed in 22.0.63124 Patch available CNA
  • Microsoft Dynamics 365 Business Central 2023 Release Wave 2 VendorMicrosoft Affected 23.0.0 to before 23.0.15712 Fixed in 23.0.15712 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:dynamics_365_business_central:2022:release_wave_2:*:*:*:*:*:*2022 release_wave_2VulnerableMicrosoft
cpe:2.3:a:microsoft:dynamics_365_business_central:2023:release_wave_1:*:*:*:*:*:*2023 release_wave_1VulnerableMicrosoft
cpe:2.3:a:microsoft:dynamics_365_business_central:2023:release_wave_2:*:*:*:*:*:*2023 release_wave_2VulnerableMicrosoft
  • cpe:2.3:a:microsoft:dynamics_365_business_central:2022:release_wave_2:*:*:*:*:*:* Versions 2022 release_wave_2 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:dynamics_365_business_central:2023:release_wave_1:*:*:*:*:*:* Versions 2023 release_wave_1 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:dynamics_365_business_central:2023:release_wave_2:*:*:*:*:*:* Versions 2023 release_wave_2 Vulnerable ·Microsoft

Remediation

  • Fix · CNA Microsoft Dynamics 365 Business Central 2022 Release Wave 2 (Microsoft) Fixed in 21.0.63175
  • Fix · CNA Microsoft Dynamics 365 Business Central 2023 Release Wave 1 (Microsoft) Fixed in 22.0.63124
  • Fix · CNA Microsoft Dynamics 365 Business Central 2023 Release Wave 2 (Microsoft) Fixed in 23.0.15712

Vendor assessments

Microsoft

Microsoft's page for this CVE →

Impact
Information Disclosure
Exploited
No
Publicly disclosed
No
Exploitability
Exploitation Less Likely
ProductStatusPlan or fix
Microsoft Dynamics 365 Business Central 2022 Release Wave 2Fixed 21.0.63175 · Security Update
Microsoft Dynamics 365 Business Central 2023 Release Wave 1Fixed 22.0.63124 · Security Update
Microsoft Dynamics 365 Business Central 2023 Release Wave 2Fixed 23.0.15712 · Security Update

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-21380
  2. 2026-10-03 Alias added: GHSA-7ffr-7c74-8mp9

References

Patch 1

  • TI-2020-00875 An remote code execution vulnerability exists in Microsoft Dynamics Business Central, aka… CVSS 3.1HIGH 8.0
  • TI-2024-25504 Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2024-23317 Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability CVSS 3.1HIGH 8.8
  • TI-2020-00991 A remote code execution vulnerability exists in Microsoft Dynamics Business Central, aka… CVSS 3.1HIGH 8.0
  • TI-2024-23316 Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability CVSS 3.1HIGH 7.3
  • TI-2020-00987 Information disclosure in Microsoft Dynamics NAV 2016 CVSS 3.1HIGH 7.5
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences