PT-2025-46505 · Microsoft · Dynamics 365 Field Service

Published 2025-11-11 · Updated 2025-11-11 · CVE-2025-62211

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Dynamics 365 Field Service (online) (affected versions not specified)

Description The issue involves improper neutralization of input during web page generation, leading to a cross-site scripting condition. An authorized attacker can perform spoofing over a network by exploiting this. The core of the issue is that user inputs are not sufficiently sanitized or encoded when rendered, allowing an attacker to inject malicious scripts into webpages viewed by legitimate users.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-14079

CVE-2025-62211

Affected Products

Dynamics 365 Field Service

References · 8

• https://osv.dev/vulnerability/CVE-2025-62211 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62211 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62211 · Security Note
• https://bdu.fstec.ru/vul/2025-14079 · Security Note
• https://twitter.com/CVEnew/status/1988348994133573644 · Twitter Post
• https://twitter.com/CveFindCom/status/1988315971572899882 · Twitter Post
• https://twitter.com/CveTodo/status/1988323165513085368 · Twitter Post
• https://t.me/CVEtracker/37056 · Telegram Post