CVE-2024-21380: Dynamics 365 Info Disclosure Flaw

CVE-2024-21380 Overview

CVE-2024-21380 is an information disclosure vulnerability affecting Microsoft Dynamics 365 Business Central and Microsoft Dynamics NAV. The flaw allows a network-based attacker with low privileges to access sensitive information belonging to other tenants or users of the platform. Successful exploitation requires user interaction and high attack complexity, but the vulnerability has a scope-changed impact, meaning it affects resources beyond the vulnerable component. Microsoft classifies the underlying weakness under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
An authenticated attacker can disclose confidential business data across tenant boundaries in Microsoft Dynamics 365 Business Central, impacting confidentiality, integrity, and availability of affected resources.

Affected Products

Microsoft Dynamics 365 Business Central 2022 Release Wave 2
Microsoft Dynamics 365 Business Central 2023 Release Wave 1
Microsoft Dynamics 365 Business Central 2023 Release Wave 2

Discovery Timeline

2024-02-13 - CVE-2024-21380 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2024-21380

Vulnerability Analysis

CVE-2024-21380 exposes sensitive information within Microsoft Dynamics 365 Business Central to attackers who possess valid low-privilege credentials on the platform. The vulnerability requires user interaction, typically in the form of a targeted user clicking a malicious link or interacting with attacker-supplied content. Once triggered, the vulnerability crosses a security scope boundary, allowing the attacker to reach data owned by other users or tenants. Microsoft's advisory categorizes this issue under CWE-200, which covers unauthorized exposure of sensitive data. The EPSS probability score for this CVE is 1.725%, placing it in the 75th percentile for likelihood of exploitation over the next 30 days.

Root Cause

The root cause is improper enforcement of authorization boundaries within the Dynamics 365 Business Central application layer. The service returns data belonging to other tenants or users when the attacker crafts a request that abuses the affected function. Microsoft's advisory does not disclose the specific component or code path.

Attack Vector

Exploitation occurs over the network against the Dynamics 365 Business Central web-facing services. The attacker must hold a valid low-privilege account and induce a legitimate user to interact with attacker-controlled input. The high attack complexity indicates that successful exploitation depends on conditions outside the attacker's direct control, such as specific tenant configuration or timing. Refer to the Microsoft Security Response Center advisory for CVE-2024-21380 for the authoritative description.

Detection Methods for CVE-2024-21380

Indicators of Compromise

Unexpected cross-tenant data appearing in exported reports, API responses, or user-facing views within Dynamics 365 Business Central.
Authenticated sessions from low-privilege accounts issuing requests to endpoints that return data outside their assigned scope.
Anomalous outbound data volumes from Business Central service accounts following user interaction with untrusted links.

Detection Strategies

Review Dynamics 365 Business Central audit logs for access patterns where accounts retrieve records outside their normal tenant or role scope.
Correlate Microsoft 365 sign-in logs with Business Central activity to identify low-privilege accounts followed by unusual data-access events.
Alert on API calls that return records with tenant identifiers that do not match the requesting user's context.

Monitoring Recommendations

Enable and forward Business Central telemetry and audit logs to a centralized SIEM for long-term retention and correlation.
Monitor for phishing campaigns targeting Business Central users, since exploitation requires user interaction.
Track privilege assignments and detect creation of new low-privilege accounts that quickly access sensitive endpoints.

How to Mitigate CVE-2024-21380

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2024-21380 to all affected Dynamics 365 Business Central environments.
Audit user accounts in Business Central and remove or disable any low-privilege accounts that are no longer required.
Warn users about phishing lures that request interaction with Business Central content, since exploitation requires user interaction.

Patch Information

Microsoft has released updates addressing CVE-2024-21380 for Dynamics 365 Business Central 2022 Release Wave 2, 2023 Release Wave 1, and 2023 Release Wave 2. Cloud tenants receive updates automatically through the Microsoft-managed service. On-premises deployments must apply the fix through the standard Business Central update channel. Consult the Microsoft Vulnerability Update for CVE-2024-21380 for the specific build numbers.

Workarounds

Restrict Business Central access to trusted networks and enforce conditional access policies through Microsoft Entra ID until patches are applied.
Require multi-factor authentication on all Business Central accounts to reduce the risk of credential-based access by attackers.
Reduce the number of accounts with any level of Business Central access to the minimum required for business operations.

bash

# Configuration example: enforce conditional access via Microsoft Graph PowerShell
Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess"
New-MgIdentityConditionalAccessPolicy \
  -DisplayName "Restrict Dynamics 365 Business Central" \
  -State "enabled" \
  -Conditions @{ Applications = @{ IncludeApplications = @("<BusinessCentral-AppId>") } } \
  -GrantControls @{ Operator = "AND"; BuiltInControls = @("mfa","compliantDevice") }