CVE-2024-38166

2024-08-0622:15:54

CWE-79

[email protected]

web.nvd.nist.gov

microsoft dynamics 365

network spoofing

link trickery

input neutralization

web page generation

unauthenticated attacker

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

27.8%

JSON

An unauthenticated attacker can exploit improper neutralization of input during web page generation in Microsoft Dynamics 365 to spoof over a network by tricking a user to click on a link.

Affected configurations

Nvd

Node

microsoftdynamics_crm_service_portal_web_resourceMatch-

VendorProductVersionCPE
microsoftdynamics_crm_service_portal_web_resource-cpe:2.3:a:microsoft:dynamics_crm_service_portal_web_resource:-:*:*:*:*:*:*:*