CVE-2025-29821 - Vulnerability Details - OpenCVE

Improper input validation in Dynamics Business Central allows an authorized attacker to disclose information locally.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29821

History

Tue, 08 Apr 2025 21:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 08 Apr 2025 17:30:00 +0000

Type	Values Removed	Values Added
Description		Improper input validation in Dynamics Business Central allows an authorized attacker to disclose information locally.
Title		Microsoft Dynamics Business Central Information Disclosure Vulnerability
Weaknesses		CWE-20
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29821
Metrics		cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C'}`

MITRE

Status: PUBLISHED

Assigner: microsoft

Published: 2025-04-08T17:23:31.840Z

Updated: 2025-04-16T00:41:30.448Z

Reserved: 2025-03-11T22:56:43.943Z

Link: CVE-2025-29821

Vulnrichment

Updated: 2025-04-08T20:03:23.640Z

NVD

Status : Awaiting Analysis

Published: 2025-04-08T18:16:07.867

Modified: 2025-04-09T20:03:01.577

Link: CVE-2025-29821

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-29821", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2025-03-11T22:56:43.943Z", "datePublished": "2025-04-08T17:23:31.840Z", "dateUpdated": "2025-04-16T00:41:30.448Z"}, "containers": {"cna": {"title": "Microsoft Dynamics Business Central Information Disclosure Vulnerability", "datePublic": "2025-04-08T07:00:00.000Z", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2024_wave_1:*:*:*:*:*:*:*:*", "versionStartIncluding": "24.0", "versionEndExcluding": "24.12.32447.0"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2023_wave_2:*:*:*:*:*:*:*:*", "versionStartIncluding": "23.0", "versionEndExcluding": "23.18.32409"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2024_wave_2:*:*:*:*:*:*:*:*", "versionStartIncluding": "25.0", "versionEndExcluding": "25.6.32556"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2025_wave_1:*:*:*:*:*:*:*:*", "versionStartIncluding": "26.0", "versionEndExcluding": "26.0.32481"}]}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft Dynamics 365 Business Central 2024 Wave 1 2024", "platforms": ["Unknown"], "versions": [{"version": "24.0", "lessThan": "24.12.32447.0", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Dynamics 365 Business Central 2023 Wave 2", "platforms": ["Unknown"], "versions": [{"version": "23.0", "lessThan": "23.18.32409", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Dynamics 365 Business Central 2024 Wave 2", "platforms": ["Unknown"], "versions": [{"version": "25.0", "lessThan": "25.6.32556", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Dynamics 365 Business Central 2025 Wave 1", "platforms": ["Unknown"], "versions": [{"version": "26.0", "lessThan": "26.0.32481", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "Improper input validation in Dynamics Business Central allows an authorized attacker to disclose information locally.", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-20: Improper Input Validation", "lang": "en-US", "type": "CWE", "cweId": "CWE-20"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2025-04-16T00:41:30.448Z"}, "references": [{"name": "Microsoft Dynamics Business Central Information Disclosure Vulnerability", "tags": ["vendor-advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29821"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "MEDIUM", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-08T20:05:23.735248Z", "id": "CVE-2025-29821", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-08T20:23:05.669Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-29821", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-08T20:05:23.735248Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-08T20:03:23.640Z"}}], "cna": {"title": "Microsoft Dynamics Business Central Information Disclosure Vulnerability", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft Dynamics 365 Business Central 2024 Wave 1 2024", "versions": [{"status": "affected", "version": "24.0", "lessThan": "24.12.32447.0", "versionType": "custom"}], "platforms": ["Unknown"]}, {"vendor": "Microsoft", "product": "Microsoft Dynamics 365 Business Central 2023 Wave 2", "versions": [{"status": "affected", "version": "23.0", "lessThan": "23.18.32409", "versionType": "custom"}], "platforms": ["Unknown"]}, {"vendor": "Microsoft", "product": "Microsoft Dynamics 365 Business Central 2024 Wave 2", "versions": [{"status": "affected", "version": "25.0", "lessThan": "25.6.32556", "versionType": "custom"}], "platforms": ["Unknown"]}, {"vendor": "Microsoft", "product": "Microsoft Dynamics 365 Business Central 2025 Wave 1", "versions": [{"status": "affected", "version": "26.0", "lessThan": "26.0.32481", "versionType": "custom"}], "platforms": ["Unknown"]}], "datePublic": "2025-04-08T07:00:00.000Z", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29821", "name": "Microsoft Dynamics Business Central Information Disclosure Vulnerability", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en-US", "value": "Improper input validation in Dynamics Business Central allows an authorized attacker to disclose information locally."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2024_wave_1:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "24.12.32447.0", "versionStartIncluding": "24.0"}, {"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2023_wave_2:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "23.18.32409", "versionStartIncluding": "23.0"}, {"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2024_wave_2:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "25.6.32556", "versionStartIncluding": "25.0"}, {"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2025_wave_1:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "26.0.32481", "versionStartIncluding": "26.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2025-04-15T17:39:33.636Z"}}}, "cveMetadata": {"cveId": "CVE-2025-29821", "state": "PUBLISHED", "dateUpdated": "2025-04-15T17:39:33.636Z", "dateReserved": "2025-03-11T22:56:43.943Z", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "datePublished": "2025-04-08T17:23:31.840Z", "assignerShortName": "microsoft"}, "dataVersion": "5.1"}