Lucene search
MicrosoftKB4538888HistoryMar 10, 2020 - 7:00 a.m.
Update 15.4 for Microsoft Dynamics 365 Business Central 2019 Release Wave 2 (Application Build 15.4.41345, Platform Build 15.0.41271)
2020-03-1007:00:00
Microsoft
support.microsoft.com
12
8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
8.3 High
AI Score
Confidence
High
6 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:S/C:P/I:P/A:P
0.024 Low
EPSS
Percentile
89.9%
Update 15.4 for Microsoft Dynamics 365 Business Central 2019 Release Wave 2 (Application Build 15.4.41345, Platform Build 15.0.41271)
This article applies to Microsoft Dynamics 365 Business Central 2019 Release Wave 2 for all countries and all language locales.A remote code execution vulnerability exists in Microsoft Dynamics NAV. A user who has the permission to access certain features that requires a call from the Role-Tailored Client that has the dataset structure can start arbitrary shell commands through deserialization.
To learn more about the vulnerability, go to CVE-2020-0905.
Overview
This update replaces previously released updates. You should always install the latest update.It may be necessary to update your license after you install this hotfix to gain access to new objects that are included in this or a previous update. (This only applies to customer licenses.)
For a list of updates that were released for Microsoft Dynamics 365 Business Central 2019 Release Wave 2, see released updates for Microsoft Dynamics 365 Business Central 2019 Release Wave 2. Updates are intended for new and existing customers who are running Microsoft Dynamics Released Updates for Microsoft Dynamics 365 Business Central 2019 Release Wave 2.
| ImportantWe recommend that you contact your Microsoft Dynamics Partner before you install hotfixes or updates. It is important to verify that your environment is compatible with the hotfixes or updates that will be installed. A hotfix or update may cause interoperability issues with customizations and third-party products that work together with your Microsoft Dynamics 365 Business Central solution.Problems that are resolved in this updateThe following problems are resolved in this update:Platform hotfixesID | Title |
|---|---|
| 346429 | Circular references between pages by using the Page Parts cause the instability of web services. |
| 345333 | Do not make public SQL Injection command and report on Business Central Help Server. |
| 340844 | Dynamically hiding visibility of a group on a page is breaking the F6 shortcut, where the focus does not go past the hidden group in the Web client. |
| 335609 | Label printer does not select the appropriate orientation when it is used through the printer selection after upgrading from CU 9. |
| 339853 | “There is no AllObj within the filter” error message is displayed in the New-NAVServerPermission cmdlet. |
| 336725 | “Sales line already exists…” error message is displayed when you sort on a column other than the Line No. field and continue to enter the new sales lines. |
| 346636 | The upgrade code might delete the customer data in the Power BI URl fields. |
| Application hotfixesID | Title |
| — | — |
| 340905 | The Rapid Start Validate Package process is extremely slow when you import a small amount of data into the table from a spreadsheet. |
| 340775 | The payment registration functionality does not work for credit memos, but credit memos are displayed on the Payment Registration page. |
| 343144 | The color of the matching lines does not change to green immediately when you use the Match function manually. |
| 341933 | “The length of the string” error message is displayed when you use a G/L account with a name with more than 50 characters in the Dimension - Detail or in the Dimension - Total report. |
| 342392 | An electronic invoice in EHF 3.0 format cannot be validated successfully when the document contains positive and negative lines and different VAT rates. |
| 343940 | The location code is not selected for the Quick Entry property when you press the ENTER button in the sales documents. |
| 340459 | Error message is displayed when you publish the modified general journal lines from Microsoft Excel. |
| 341359 | The Customer - Balance to Date report doesn’t display anything although there is a balance for a customer. |
| 344056 | Inconsistent posting dates display in the vendor ledger entries and a vendor payment transaction, and cause differences between G/L and subledger. |
| 340892 | “The changes to the Item Category record cannot be saved” error message is displayed when the Parent Category field is validated on the Item Category page. |
| 343279 | The unit cost with the open outbound entries on the Item card are extremely high. |
| 341572 | The closed inventory period will block the correct posted purchase invoice for a posted invoice that only had G/L accounts posted on a posting date prior to the closed inventory period. |
| 344042 | A reduction performance displays in the exponential adjust cost after you post double entries. |
| 339707 | The low-level code on the Production BOM page is against the Quantity Explosion of BOM report. |
| 340161 | “Not all routing lines are sequenced forward on routing” error message is displayed during the certification process for parallel routings when one of the parallel branches is longer than other branch for 4 steps. |
| 340523 | The consumption is missing with backflushing when the output has been previously reversed and per quantity is below rounding precision. |
| 341859 | The E-mail field in the Customer/Vendor card does not allow more than one Email ID in Business Central on-premises. |
| 338887 | An error message is displayed if you select more than one item with the extended text by using the Select Items function. |
| 338465 | The line is inserted into the General Posting Setup after you enter the purchase invoice line in Microsoft Dynamics 365 Business Central. |
| 339552 | After you pull the drop ship lines from a sales order into a purchase order, the custom Customer Address field has the incorrect value in the State field. |
| 346504 | “The length of the string is *, but it must be less than or equal to 250” error message is displayed in all Power BI embed scenarios. |
| 338283 | If you set a Link Target page to a workflow response, the related notification which is sent does not report the link. |
| 340604 | If you open the Customer Card page from the Sales Order Page, no date filter will be applied. |
| 341169 | Error when trying to apply Customer, Vendor and Item template with Dimension values. |
| 342441 | The Work Description field is not printed in the Standard Credit Memo report. |
| 342469 | The ApplicationArea property for the Work Order action item on the page is incorrect. |
| 343184 | The company email address is not printed correctly in the Customer Receipt Payment report. |
| 336725 | "Sales line already exists… " error message is displayed when you sort on a column other than the Line No. field and continue to enter new sales lines. |
| 344370 | "The Item does not exist. Identification fields and values: No.=‘XXX’ " error message is displayed when you search on few characters of Item No. in the sales order. |
| 339308 | "The filter ‘’ |
| 339578 | “The length of the string is 1032, but it must be less than or equal to 1024 characters…” error message is displayed in the Activities section on the Warehouse Worker Starting page when a high number of locations are assigned to the user. |
| 339664 | A lot of information is lost in the created movement. |
| 340313 | “Qty. to Handle (Base) in Tracking Specification for Item No. X, Serial No.: , Lot No.: L is currently 20. It must be 10” error message when you post an inventory pick due to the unnecessary item tracking lines. |
| 340383 | Error message does not display in the item No. that is blocked when the purchasing is blocked. |
| 342700 | The Available Qty. to Pick fields in the Pick worksheet include quantities that are reserved for other source documents. |
| Local application hotfixes****APACID | Title |
| — | — |
| 340296 | The post code is not populated when you import by using the configuration package and validate the country/region code, County and City fields in the APAC version. |
| AT – AustriaID | Title |
| — | — |
| 344449 | The Intrastat file for January 2020 is not accepted by the authorities because the period is incorrect in the Austrian version. |
| BE – BelgianID | Title |
| — | — |
| 338020 | If you use the Export Payment Lines function in the Payment Journal, the global dimensions are not transferred correctly in the Belgian version. |
| CZ - CzechID | Title |
| — | — |
| 343087 | The Type Refund is missing on the issued Payment Order Line in the Czech version. |
| 341597 | The Original Document VAT Date field is missing on sales return orders in the Czech version. |
| 342998 | The correction of image and tooltip is in the multiple interest rates in the Czech version. |
| 345287 | The alignment should be with the standard according to Cumulative Update 03 for Microsoft Dynamics 365 Business Central on-premises in the Czech version. |
| 341652 | The FA Subclass code is changed on the fixed asset card in the Czech version. |
| 343088 | The decimal places are in the depreciation groups in the Czech version. |
| 343025 | Cancel the incorrect record creation in the posted transfer shipment in the Czech version. |
| 343750 | Add attachments to the documents in the Czech version. |
| 342999 | Different transactions of the VAT Country/Region code on an invoice and credit memo when you use the Ship-to Code field in the Czech version. |
| 343081 | A problem is displayed when you copy an archived document with an Item Charge in the Czech version. |
| 344776 | “Prepmt. Amt. Inv. Excl. VAT cannot be less than xxx in Sales Line” error message is displayed when you create multiple shipments for orders with advance letters in the Czech version. |
| 343002 | An export error message is displayed in the VAT-VIES declaration report if the EU Service field is set to No and the Trade Role Type field is set to Intermediate Trade in the Czech version. |
| 343687 | The VAT Entries merge into one line with different VAT date and the same External Document No. field in the VAT Control report in the Czech version. |
| 343743 | The visibility of the Document No. field and checking Series No. field in the VAT Control report in the Czech version. |
| 343745 | A new page for the VAT Control Report Lines in the Czech version. |
| 343022 | Add a new parameter in the Create Stockkeeping Unit report in the Czech version. |
| DACHID | Title |
| — | — |
| 341880 | Incorrect INDEX.XML file is in the GDPdU data export when the same table is used multiple times in the DACH version. |
| 344449 | The Intrastat file for January 2020 is not accepted by the authorities because the period is incorrect in the DACH version. |
| DK – DenmarkID | Title |
| — | — |
| 341094 | The information in the LineExtensionAmount tag of the OIOUBL E-invoicing is incorrect in case a line discount is granted in the Danish version. |
| FR – FranceID | Title |
| — | — |
| 343821 | The Reminder report looks odd because some values are cut and transferred to the next page in the French version. |
| IT – ItalyID | Title |
| — | — |
| 339234 | The official debit amount and official credit amount are not exposed on the General Ledger Setup page in the Italian version. |
| 341872 | The VAT Exemption No. field should be enlarged in the Italian version. |
| NA – North AmericaID | Title |
| — | — |
| 336725 | "Sales line already exists… " error message is displayed when you sort on a column other than the Line No. field and continue to enter new sales lines in the North American version. |
| NL – NetherlandsID | Title |
| — | — |
| 341996 | “The SourceExpr for report control ‘NoSourceName’ is not valid. …” error message is displayed when you try to print the Proposal Overview report and use the customer or vendor names with more than 50 characters in the Dutch version. |
| NO – NorwayID | Title |
| — | — |
| 340141 | If you use the reverse charge VAT and proportional VAT, the transaction does not display correctly in the Trade Settlement report in the Norwegian version. |
| Local regulatory features****NO – NorwayID | Title |
| — | — |
| 341487 | The Payroll functionality can consider zero values like no values in the Norwegian version. |
Resolution
| How to obtain the Microsoft Dynamics 365 Business Central 2019 Release Wave 2 filesThis update is available for manual download and installation from the Microsoft Download Center.Update 15.4 for Microsoft Dynamics 365 Business Central 2019 Release Wave 2Which hotfix package to downloadThis update has multiple hotfix packages. Select and download one of the following packages depending on the country version of your Microsoft Dynamics 365 Business Central 2019 database:Country | Hotfix package |
|---|---|
| AT - Austria | Download update 15.4 for Microsoft Dynamics 365 Business Central 2019 Release Wave 2 AT package |
| AU - Australia | Download update 15.4 for Microsoft Dynamics 365 Business Central 2019 Release Wave 2 AU package |
| BE - Belgium | Download update 15.4 for Microsoft Dynamics 365 Business Central 2019 Release Wave 2 BE package |
| CH - Switzerland | Download update 15.4 for Microsoft Dynamics 365 Business Central 2019 Release Wave 2 CH package |
| CZ- Czech | Download update 15.4 for Microsoft Dynamics 365 Business Central 2019 Release Wave 2 CZ package |
| DE - Germany | Download update 15.4 for Microsoft Dynamics 365 Business Central 2019 Release Wave 2 DE package |
| DK - Denmark | Download update 15.4 for Microsoft Dynamics 365 Business Central 2019 Release Wave 2 DK package |
| ES - Spain | Download update 15.4 for Microsoft Dynamics 365 Business Central 2019 Release Wave 2 ES package |
| FI - Finland | Download update 15.4 for Microsoft Dynamics 365 Business Central 2019 Release Wave 2 FI package |
| FR - France | Download update 15.4 for Microsoft Dynamics 365 Business Central 2019 Release Wave 2 FR package |
| IS - Iceland | Download update 15.4 for Microsoft Dynamics 365 Business Central 2019 Release Wave 2 IS package |
| IT - Italy | Download update 15.4 for Microsoft Dynamics 365 Business Central 2019 Release Wave 2 IT package |
| NA - North America | Download update 15.4 for Microsoft Dynamics 365 Business Central 2019 Release Wave 2 NA package |
| NL - Netherlands | Download update 15.4 for Microsoft Dynamics 365 Business Central 2019 Release Wave 2 NL package |
| NO - Norway | Download update 15.4 for Microsoft Dynamics 365 Business Central 2019 Release Wave 2 NO package |
| NZ - New Zealand | Download update 15.4 for Microsoft Dynamics 365 Business Central 2019 Release Wave 2 NZ package |
| RU - Russia | Download update 15.4 for Microsoft Dynamics 365 Business Central 2019 Release Wave 2 RU package |
| SE - Sweden | Download update 15.4 for Microsoft Dynamics 365 Business Central 2019 Release Wave 2 SE package |
| UK - United Kingdom | Download update 15.4 for Microsoft Dynamics 365 Business Central 2019 Release Wave 2 UK package |
| All other countries | Download update 15.4 for Microsoft Dynamics 365 Business Central 2019 Release Wave 2 W1 package |
| How to install a Microsoft Dynamics 365 Business Central 2019 Release Wave 2 updateSee How to install a Microsoft Dynamics 365 Business Central 2019 Release Wave 2 update.PrerequisitesYou must have Microsoft Dynamics 365 Business Central 2019 Release Wave 2 installed to apply this hotfix. |
More information
See more information about software update terminology and Microsoft Dynamics 365 Business Central 2019 Release Wave 2.
Status
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the “Applies to” section.
Related
prion
prion
Remote code execution
2020-03-12 16:15:00
mskb
mskb
mscve
mscve
Dynamics Business Central Remote Code Execution Vulnerability
2020-03-10 07:00:00
nessus
nessus
Security Updates for Microsoft Dynamics NAV (Mar 2020)
2020-05-11 00:00:00
Security Updates for Microsoft Dynamics 365 Business Central (Mar 2020)
2020-05-11 00:00:00
cve
cve
CVE-2020-0905
2020-03-12 16:15:00
kaspersky
kaspersky
KLA11683 ACE vulnerability in Microsoft Dynamics
2020-03-10 00:00:00
qualysblog
qualysblog
8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
8.3 High
AI Score
Confidence
High
6 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:S/C:P/I:P/A:P
0.024 Low
EPSS
Percentile
89.9%
Related for KB4538888