KLA11953 Multiple vulnerabilities in Microsoft Dynamics

Multiple vulnerabilities were found in Microsoft Dynamics 365. Malicious users can exploit these vulnerabilities to spoof user interface, execute arbitrary code.

Below is a complete list of vulnerabilities:

1. A cross-site-scripting (XSS) vulnerability Microsoft Dynamics 365 (On-Premise) can be exploited remotely via specially crafted web to spoof user interface.
2. A remote code execution vulnerability in Microsoft Dynamics 365 (on-premises) can be exploited remotely via specially crafted request to execute arbitrary code.
3. A remote code execution vulnerability in Microsoft Dynamics 365 for Finance and Operations (on-premises) can be exploited remotely via specially crafted file to execute arbitrary code.

Original advisories

CVE-2020-16872

CVE-2020-16860

CVE-2020-16862

CVE-2020-16864

CVE-2020-16878

CVE-2020-16861

CVE-2020-16871

CVE-2020-16858

CVE-2020-16859

CVE-2020-16857

Related products

Microsoft-Dynamics-365

CVE list

CVE-2020-16872 critical

CVE-2020-16860 high

CVE-2020-16862 high

CVE-2020-16864 high

CVE-2020-16878 high

CVE-2020-16861 high

CVE-2020-16871 high

CVE-2020-16858 high

CVE-2020-16859 high

CVE-2020-16857 high

KB list

4577501

4574742

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• Dynamics 365 for Finance and OperationsMicrosoft Dynamics 365 (on-premises) version 9.0Microsoft Dynamics 365 (on-premises) version 8.2