Vulnerability · Published Aug 6, 2024 · Assigned by microsoft
CVE-2024-38166Microsoft Dynamics 365 Cross-site Scripting Vulnerability
High 8.2
In plain English
A high-severity cross-site scripting in Dynamics CRM Service Portal Web Resource from Microsoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities).
Severity (CVSS 3.1)8.2High
Exploit odds (30 days)0.8%top 44.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An unauthenticated attacker can exploit improper neutralization of input during web page generation in Microsoft Dynamics 365 to spoof over a network by tricking a user to click on a link.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Dynamics CRM Service Portal Web Resource | N/A |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N/E:U/RL:O/RC:C
References
- Microsoft Dynamics 365 Cross-site Scripting Vulnerability vendor-advisory