CVE-2020-1018

Severity Score

7.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

An information disclosure vulnerability exists when Microsoft Dynamics Business Central/NAV on-premise does not properly hide the value of a masked field when showing the records as a chart page.The attacker who successfully exploited the vulnerability could see the information that are in a masked field.The security update addresses the vulnerability by updating the rendering engine the Windows client to properly detect masked fields and render the content as masked., aka 'Microsoft Dynamics Business Central/NAV Information Disclosure'.

Hay una vulnerabilidad de divulgación de información cuando Microsoft Dynamics Business Central/NAV en sitio no oculta apropiadamente el valor de un campo enmascarado cuando se muestran los registros como una página de gráficos. El atacante que explotara con éxito la vulnerabilidad podría visualizar la información que se encuentra en un campo enmascarado. La actualización de seguridad aborda la vulnerabilidad mediante la actualización del motor de renderizado del cliente de Windows para detectar apropiadamente los campos enmascarados y renderizar el contenido como enmascarado., también se conoce como "Microsoft Dynamics Business Central/NAV Information Disclosure".

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2019-11-04 CVE Reserved
2020-04-15 CVE Published
2024-08-04 CVE Updated
2024-09-11 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1018	2020-04-22

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Microsoft Search vendor "Microsoft"		Dynamics 365 Business Central Search vendor "Microsoft" for product "Dynamics 365 Business Central"				-		-		Affected
Microsoft Search vendor "Microsoft"		Dynamics 365 Business Central Search vendor "Microsoft" for product "Dynamics 365 Business Central"				2019 Search vendor "Microsoft" for product "Dynamics 365 Business Central" and version "2019"		spring_update		Affected
Microsoft Search vendor "Microsoft"		Dynamics Nav Search vendor "Microsoft" for product "Dynamics Nav"				2015 Search vendor "Microsoft" for product "Dynamics Nav" and version "2015"		-		Affected
Microsoft Search vendor "Microsoft"		Dynamics Nav Search vendor "Microsoft" for product "Dynamics Nav"				2016 Search vendor "Microsoft" for product "Dynamics Nav" and version "2016"		-		Affected
Microsoft Search vendor "Microsoft"		Dynamics Nav Search vendor "Microsoft" for product "Dynamics Nav"				2017 Search vendor "Microsoft" for product "Dynamics Nav" and version "2017"		-		Affected
Microsoft Search vendor "Microsoft"		Dynamics Nav Search vendor "Microsoft" for product "Dynamics Nav"				2018 Search vendor "Microsoft" for product "Dynamics Nav" and version "2018"		-		Affected