CVE-2024-43476 is a cross-site scripting vulnerability (CWE-79) in Microsoft Dynamics 365 (on-premises) version 9.1. It arises from improper neutralization of input during web page generation, potentially enabling an attacker with limited privileges to execute scripts that could compromise confidentiality and integrity. The CVSS v3.1 base score is 7.6, indicating high severity, with network attack vector, low attack complexity, and partial user interaction required. Microsoft has acknowledged the vulnerability and issued an official fix. The affected product is a cloud service variant of Dynamics 365 on-premises, and the vendor manages remediation for this service. No known exploits have been reported in the wild as of the publication date.

Successful exploitation could lead to partial confidentiality impact and low integrity impact without affecting availability. The attacker requires low privileges and some user interaction to exploit the vulnerability remotely. This could allow execution of malicious scripts within the context of the affected application, potentially leading to unauthorized data access or manipulation.

An official fix is available from Microsoft. Users should apply the security update as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43476. Since this is a cloud service, Microsoft manages remediation server-side for the cloud-hosted service. Check the vendor advisory for confirmation of patch deployment status. No additional mitigation actions are required beyond applying the official fix.