CVE-2020-16862
Microsoft Dynamics 365 (on-premises) Remote Code Execution Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
<p>A remote code execution vulnerability exists in Microsoft Dynamics 365 (on-premises) when the server fails to properly sanitize web requests to an affected Dynamics server. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SQL service account.
An authenticated attacker could exploit this vulnerability by sending a specially crafted request to a vulnerable Dynamics server.
The security update addresses the vulnerability by correcting how Microsoft Dynamics 365 (on-premises) validates and sanitizes user input.</p>
Se presenta una vulnerabilidad de ejecución de código remota en Microsoft Dynamics 365 (en sitio) cuando el servidor presenta un fallo al sanear apropiadamente las peticiones web hacia un servidor Dynamics afectado, también se conoce como "Microsoft Dynamics 365 (on-premises) Remote Code Execution Vulnerability". Este ID de CVE es diferente de CVE-2020-16860
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-08-04 CVE Reserved
- 2020-09-11 CVE Published
- 2024-08-04 CVE Updated
- 2024-09-18 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
CAPEC
References (1)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16862 | 2023-12-31 |
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Microsoft Search vendor "Microsoft" | Dynamics 365 Search vendor "Microsoft" for product "Dynamics 365" | 9.0 Search vendor "Microsoft" for product "Dynamics 365" and version "9.0" | - |
Affected
|