Severe Security Flaws Patched in Microsoft Dynamics 365 and Power Apps Web API
Information has surfaced regarding three security flaws in Dynamics 365 and Power Apps Web API that have been fixed and may expose data.
As of May 2024, Stratus Security, a cybersecurity firm based in Melbourne, had fixed the vulnerabilities. Power Platform's OData Web API Filter is responsible for two of the three flaws, and the FetchXML API is the source of the third.
The first vulnerability stems from the OData Web API Filter's lack of access restriction, which makes it possible to access the contacts table, which contains private data including complete names, phone numbers, addresses, financial information, and password hashes.
A threat actor might then use the vulnerability to execute a boolean-based search read more about Severe Security Flaws Patched in Microsoft Dynamics...