7.1
High
CVE-2020-16857 A remote code execution vulnerability exists in Microsoft Dynamics 365 for Finance and Operations (on-premises)…
Description
<p>A remote code execution vulnerability exists in Microsoft Dynamics 365 for Finance and Operations (on-premises) version 10.0.11. An attacker who successfully exploited this vulnerability could gain remote code execution via server-side script execution on the victim server.</p> <p>An authenticated attacker with privileges to import and export data could exploit this vulnerability by sending a specially crafted file to a vulnerable Dynamics server.</p> <p>The security update addresses the vulnerability by correcting how Microsoft Dynamics 365 for Finance and Operations (on-premises) version 10.0.11 handles user input.</p>
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Dynamics 365 for Finance and Operations 10.0 | 10.0.0 → latest | No fix stated |
References
- portal.msrc.microsoft.com portal.msrc.microsoft.com
Timeline
- Published
- Last modified
Other CVEs of Dynamics 365 for Finance and Operations
The 8 CVEs of Dynamics 365 for Finance and Operations →
CVE-2023-35621
Microsoft Dynamics 365 Finance and Operations Denial of Service Vulnerability
7.5
High
CVE-2023-36800
Dynamics Finance and Operations Cross-site Scripting Vulnerability
7.6
High
CVE-2023-24896
Dynamics 365 Finance Spoofing Vulnerability
5.4
Medium
CVE-2021-28461
Dynamics Finance and Operations Cross-site Scripting Vulnerability
6.1
Medium