CVE-2021-40440 - Vulnerability Details - OpenCVE

Microsoft Dynamics Business Central Cross-site Scripting Vulnerability

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00983.

Key SSVC decision points have not yet been added.

Vendors	Products
Microsoft	Dynamics 365 Business Central Dynamics 365 Business Central 2020 Dynamics 365 Business Central 2021

Configuration 1 [-]

OR	cpe:2.3:a:microsoft:dynamics_365_business_central:2020:update_17.10:release_wave_2:::::*
	cpe:2.3:a:microsoft:dynamics_365_business_central:2021:update_18.5:release_wave_1:::::*

No data.

No data.

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40440
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40440

History

Mon, 10 Aug 2026 15:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Microsoft dynamics 365 Business Central 2020 Microsoft dynamics 365 Business Central 2021
CPEs		cpe:2.3:a:microsoft:dynamics_365_business_central_2020::update_17.10:release_wave_2::::: cpe:2.3:a:microsoft:dynamics_365_business_central_2021::update_18.5:release_wave_1:::::
Vendors & Products		Microsoft dynamics 365 Business Central 2020 Microsoft dynamics 365 Business Central 2021
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40440

MITRE

Status: PUBLISHED

Assigner: microsoft

Published: 2021-09-15T11:24:25.000Z

Updated: 2026-08-10T15:11:10.113Z

Reserved: 2021-09-02T00:00:00.000Z

Link: CVE-2021-40440

Vulnrichment

No data.

NVD

Status : Modified

Published: 2021-09-15T12:15:16.367

Modified: 2026-06-17T04:06:55.337

Link: CVE-2021-40440

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"title": "Microsoft Dynamics Business Central Cross-site Scripting Vulnerability", "datePublic": "2021-09-14T14:00:00.000Z", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2020:*:update_17.10:release_wave_2:*:*:*:*:*", "versionStartIncluding": "17.0.0.0", "versionEndExcluding": "17.0.29460"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central_2021:*:update_18.5:release_wave_1:*:*:*:*:*", "versionStartIncluding": "18.0.0.0", "versionEndExcluding": "18.0.29486"}]}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft Dynamics 365 Business Central 2020 Release Wave 2 \u2013 Update 17.10", "versions": [{"version": "17.0.0.0", "lessThan": "17.0.29460", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Dynamics 365 Business Central 2021 Release Wave 1 - Update 18.5", "versions": [{"version": "18.0.0.0", "lessThan": "18.0.29486", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "Microsoft Dynamics Business Central Cross-site Scripting Vulnerability", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "Spoofing", "lang": "en-US", "type": "Impact"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-08-10T15:11:10.113Z"}, "references": [{"name": "Microsoft Dynamics Business Central Cross-site Scripting Vulnerability", "tags": ["vendor-advisory", "patch"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40440"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "MEDIUM", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:C"}}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T02:44:10.250Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40440"}]}]}, "cveMetadata": {"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "assignerShortName": "microsoft", "cveId": "CVE-2021-40440", "datePublished": "2021-09-15T11:24:25.000Z", "dateReserved": "2021-09-02T00:00:00.000Z", "dateUpdated": "2026-08-10T15:11:10.113Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:microsoft:dynamics_365_business_central:2020:update_17.10:release_wave_2:*:*:*:*:*"], "platforms": ["Unknown"], "product": "Microsoft Dynamics 365 Business Central 2020 Release Wave 2 \u2013 Update 17.10", "vendor": "Microsoft", "versions": [{"lessThan": "App Build 17.10.29463, Platform Build 17.0.29460", "status": "affected", "version": "17.0.0.0", "versionType": "custom"}]}, {"cpes": ["cpe:2.3:a:microsoft:dynamics_365_business_central:2021:update_18.5:release_wave_1:*:*:*:*:*"], "platforms": ["Unknown"], "product": "Microsoft Dynamics 365 Business Central 2021 Release Wave 1 - Update 18.5", "vendor": "Microsoft", "versions": [{"lessThan": "App Build 18.5.29545, Platform Build 18.0.29486", "status": "affected", "version": "18.0.0.0", "versionType": "custom"}]}], "source": "secure@microsoft.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central:2020:update_17.10:release_wave_2:*:*:*:*:*", "matchCriteriaId": "63AA9351-5B16-4610-BD4C-BAF95ABF327F", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:dynamics_365_business_central:2021:update_18.5:release_wave_1:*:*:*:*:*", "matchCriteriaId": "D3D8694C-E7BE-4555-958E-BA1D8FD750C4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Microsoft Dynamics Business Central Cross-site Scripting Vulnerability"}, {"lang": "es", "value": "Una vulnerabilidad de tipo Cross-site Scripting de Microsoft Dynamics Business Central"}], "id": "CVE-2021-40440", "lastModified": "2026-06-17T04:06:55.337", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "secure@microsoft.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Secondary"}]}, "published": "2021-09-15T12:15:16.367", "references": [{"source": "secure@microsoft.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40440"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40440"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}