Vulnerability · Published Oct 16, 2020 · Assigned by microsoft
CVE-2020-16943Dynamics 365 Commerce Elevation of Privilege Vulnerability
Medium 6.5
In plain English
A medium-severity security flaw in Dynamics 365 Commerce version 10.0.12 from Microsoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).
Official description
<p>An elevation of privilege vulnerability exists in Microsoft Dynamics 365 Commerce. An unauthenticated attacker who successfully exploited this vulnerability could update data without proper authorization.</p> <p>To exploit the vulnerability, an attacker would need to send a specially crafted request to an affected server.</p> <p>The security update addresses the vulnerability by correcting how Microsoft Dynamics 365 Commerce performs authorization checks.</p>
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Dynamics 365 Commerce version 10.0.12 | 10.0.0 – before publication |
| Microsoft | Dynamics 365 Commerce version 10.0.13 | 10.0.0 – before publication |
| Microsoft | Dynamics 365 Commerce version 10.0.14 | 10.0.0 – before publication |
| Microsoft | Dynamics 365 Commerce version 10.0.15 | 10.0.0 – before publication |
| Microsoft | Dynamics 365 Commerce version 10.0.16 | 10.0.0 – before publication |