CVE-2020-1063 : Security Advisory and Response

Microsoft Dynamics 365 (On-Premise) Cross Site Scripting Vulnerability

Understanding CVE-2020-1063

A cross-site scripting vulnerability in Microsoft Dynamics 365 (on-premises) allows specially crafted web requests to target affected servers.

What is CVE-2020-1063?

This vulnerability arises when Microsoft Dynamics 365 (on-premises) fails to adequately sanitize specific web requests, leading to a cross-site scripting risk.

The Impact of CVE-2020-1063

Allows malicious actors to execute scripts in the victim's browser, potentially compromising confidential data
Attackers can impersonate users or carry out other spoofing activities

Technical Details of CVE-2020-1063

The following technical details describe the vulnerability in more depth.

Vulnerability Description

Type: Cross-site scripting (XSS)
Exploit: Specially crafted web requests

Affected Systems and Versions

Microsoft Dynamics 365 (on-premises) versions 8.2 and 9.0

Exploitation Mechanism

An attacker sends a specially crafted web request to a vulnerable Dynamics server

Mitigation and Prevention

Users and administrators can take immediate steps to address and prevent exploitation of this vulnerability.

Immediate Steps to Take

Apply the latest security updates provided by Microsoft for Dynamics 365
Implement strict input validation mechanisms to sanitize user inputs
Educate users about the risks of clicking on suspicious links or downloading files

Long-Term Security Practices

Regularly update and patch software to address security vulnerabilities
Conduct security assessments and penetration testing to identify and remediate weaknesses

Patching and Updates

Stay informed about security advisories and updates from Microsoft Dynamics 365