PT-2020-3960 · Microsoft · Dynamics 365

Ashar Javed · Published 2020-09-08 · Updated 2023-12-31 · CVE-2020-16859

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Microsoft Dynamics 365 (affected versions not specified)

Description: The issue is related to insufficient protection of the web page structure in Microsoft Dynamics 365, allowing for cross-site scripting attacks. An authenticated attacker could exploit this by sending a specially crafted request to an affected Dynamics server, potentially leading to the execution of scripts in the context of the current authenticated user. This could enable the attacker to read unauthorized content, use the victim's identity to take actions within the Dynamics server, and inject malicious content into the user's browser.

Recommendations: For Microsoft Dynamics 365, apply the security update that addresses the vulnerability by ensuring Dynamics Server properly sanitizes web requests. As a temporary workaround, consider restricting access to sensitive areas of the Dynamics server to minimize the risk of exploitation.

Fix

Spoofing

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2020-04353

CVE-2020-16859

Affected Products

Dynamics 365

References · 4

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16859 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-16859 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-16859 · Security Note
• https://bdu.fstec.ru/vul/2020-04353 · Security Note