Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
kasperskyKaspersky LabKLA11999
HistoryNov 10, 2020 - 12:00 a.m.

KLA11999 Multiple vulnerabilities in Microsoft Dynamics

2020-11-1000:00:00
Kaspersky Lab
threats.kaspersky.com
14
microsoft dynamics
cross-site scripting
versions 7.0 8.2 9.0

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

AI Score

5

Confidence

High

EPSS

0.001

Percentile

20.3%

JSON

Multiple vulnerabilities was found in Microsoft Dynamics. Malicious users can exploit this vulnerability to perform cross-site scripting attack.

Original advisories

CVE-2020-17018

CVE-2020-17005

CVE-2020-17006

CVE-2020-17021

Related products

Microsoft-Dynamics-365

CVE list

CVE-2020-17018 high

CVE-2020-17005 high

CVE-2020-17006 high

CVE-2020-17021 high

KB list

4584612

4577009

4584611

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

  • XSS/CSS

Cross site scripting. Exploitation of vulnerabilities with this impact can lead to partial interception of information transmitted between user and site.

Affected Products

  • Microsoft Dynamics 365 (on-premises) version 9.0Microsoft Dynamics CRM 2015 (on-premises) version 7.0Microsoft Dynamics 365 (on-premises) version 8.2

Related

nessus 1
mskb 3
nvd 4
cvelist 4
mscve 4
prion 4
cve 4
nessus
nessus
Security Updates for Microsoft Dynamics 365 (on-premises) (November 2020)
2020-11-10 00:00:00
mskb
mskb
Service Update 0.22 for Microsoft Dynamics 365 9.0
2020-11-10 08:00:00
Microsoft Dynamics 365 (on-premises) Update 2.24
2020-11-10 08:00:00
7.0 Train 20092 (9.2) - On Premise 0.3 Hotfix 5
2020-11-10 08:00:00
nvd
nvd
CVE-2020-17018
2020-11-11 07:15:14
CVE-2020-17021
2020-11-11 07:15:14
CVE-2020-17006
2020-11-11 07:15:14
cvelist
cvelist
CVE-2020-17018 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
2020-11-11 06:48:05
CVE-2020-17021 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
2020-11-11 06:48:06
CVE-2020-17006 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
2020-11-11 06:48:00
mscve
mscve
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
2020-11-10 08:00:00
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
2020-11-10 08:00:00
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
2020-11-10 08:00:00
prion
prion
Cross site scripting
2020-11-11 07:15:00
Cross site scripting
2020-11-11 07:15:00
Cross site scripting
2020-11-11 07:15:00
cve
cve
CVE-2020-17018
2020-11-11 07:15:14
CVE-2020-17021
2020-11-11 07:15:14
CVE-2020-17005
2020-11-11 07:15:13

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

AI Score

5

Confidence

High

EPSS

0.001

Percentile

20.3%

JSON
Related for KLA11999
nessus1mskb3nvd4cvelist4mscve4prion4cve4