Vulnerability · Published Sep 11, 2020 · Assigned by microsoft
CVE-2020-16857Microsoft Dynamics 365 for Finance and Operations (on-premises) Remote Code Execution Vulnerability
High 7.1
In plain English
A high-severity security flaw in Dynamics 365 for Finance and Operations from Microsoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.7% (higher than 86% of all known vulnerabilities).
Official description
<p>A remote code execution vulnerability exists in Microsoft Dynamics 365 for Finance and Operations (on-premises) version 10.0.11. An attacker who successfully exploited this vulnerability could gain remote code execution via server-side script execution on the victim server.</p> <p>An authenticated attacker with privileges to import and export data could exploit this vulnerability by sending a specially crafted file to a vulnerable Dynamics server.</p> <p>The security update addresses the vulnerability by correcting how Microsoft Dynamics 365 for Finance and Operations (on-premises) version 10.0.11 handles user input.</p>
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Dynamics 365 for Finance and Operations | 10.0.0 – before publication |