8.2 High

CVE-2024-38166 An unauthenticated attacker can exploit improper neutralization of input during web page generation in Microsoft…

Description

An unauthenticated attacker can exploit improper neutralization of input during web page generation in Microsoft Dynamics 365 to spoof over a network by tricking a user to click on a link.

Affected products and versions

Product	Affected versions	Fixed in
Dynamics CRM Service Portal Web Resource	Versions not published

Do you use Dynamics CRM Service Portal Web Resource?

Track this CVE Watch Dynamics CRM Service Portal Web Resource Check my SBOMs

www.cveye.io/en/cve/CVE-2024-38166

Timeline

Published August 6, 2024
Last modified July 10, 2025

References

Microsoft Dynamics 365 Cross-site Scripting Vulnerability msrc.microsoft.com

Track this CVE