PT-2020-3978 · Microsoft · Dynamics 365

Suresh C · Published 2020-08-09 · Updated 2023-12-31 · CVE-2020-16871

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Microsoft Dynamics 365 (on-premises) (affected versions not specified)

Description: A cross-site scripting issue exists due to inadequate protection of the web page structure. This could allow a remote attacker to perform cross-site scripting attacks using a specially crafted request. An authenticated attacker could exploit this by sending a specially crafted request to the affected Dynamics server, potentially allowing them to read unauthorized content, use the victim's identity to take actions within the Dynamics Server, change permissions, delete content, and inject malicious content into the user's browser.

Recommendations: For Microsoft Dynamics 365 (on-premises), apply the security update that addresses the vulnerability by ensuring Dynamics Server properly sanitizes web requests. As a temporary workaround, consider restricting access to sensitive areas of the Dynamics Server to minimize the risk of exploitation.

Fix

Spoofing

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2020-04372

CVE-2020-16871

Affected Products

Dynamics 365

References · 4

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16871 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-16871 · Security Note
• https://bdu.fstec.ru/vul/2020-04372 · Security Note
• https://osv.dev/vulnerability/CVE-2020-16871 · Vendor Advisory