Kaspersky LabKLA11683KLA11683 ACE vulnerability in Microsoft Dynamics
8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
6 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:S/C:P/I:P/A:P
0.019 Low
EPSS
Percentile
88.5%
Detect date:
03/10/2020
Severity:
Critical
Description:
ACE vulnerability was found in Microsoft Dynamics. Malicious users can exploit this vulnerability to execute arbitrary code.
Affected products:
Microsoft Dynamics NAV 2015
Microsoft Dynamics NAV 2017
Microsoft Dynamics NAV 2016
Microsoft Dynamics 365 BC On Premise
Dynamics 365 Business Central 2019 Spring Update
Microsoft Dynamics NAV 2013
Dynamics 365 Business Central 2019 Release Wave 2 (On-Premise)
Microsoft Dynamics NAV 2018
Solution:
Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)
Original advisories:
Impacts:
ACE
Related products:
CVE-IDS:
CVE-2020-09056.0High
KB list:
4538885
4538886
4538884
4538888
4551259
4538708
4551258
4538887
Microsoft official advisories:
References
support.microsoft.com/kb/4538708
support.microsoft.com/kb/4538884
support.microsoft.com/kb/4538885
support.microsoft.com/kb/4538886
support.microsoft.com/kb/4538887
support.microsoft.com/kb/4538888
support.microsoft.com/kb/4551258
support.microsoft.com/kb/4551259
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0905
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-0905
portal.msrc.microsoft.com/en-us/security-guidance
statistics.securelist.com/vulnerability-scan/month
threats.kaspersky.com/en/product/Microsoft-Dynamics-365/
Related
8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
6 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:S/C:P/I:P/A:P
0.019 Low
EPSS
Percentile
88.5%