Read the docs
TI-2020-12869 Aliases CVE-2020-16871GHSA-g4jp-7cc6-648m

Microsoft Dynamics 365 (On-Premise) Cross Site Scripting Vulnerability

Priority LOW 28CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

<p>A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an affected Dynamics server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected Dynamics server.</p> <p>The attacker who successfully exploited the vulnerability could then perform cross-site scripting attacks on affected systems and run script in the security context of the current authenticated user. These attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim's identity to take actions within Dynamics Server on behalf of the user, such as change permissions and delete content, and inject malicious content in the browser of the user.</p> <p>The security update addresses the vulnerability by helping to ensure that Dynamics Server properly sanitizes web requests.</p>

Why it matters now

EPSS 0.01634 76th percentileScored 2026-11-07
Fix Fixed Microsoft Dynamics 365 (on-premises) version 8.2 (Microsoft): publicationMicrosoft Dynamics 365 (on-premises) version 9.0 (Microsoft): publication

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftMicrosoft Dynamics 365 (on-premises) version 8.28.0 to before publicationpublicationPatch availableCNA
MicrosoftMicrosoft Dynamics 365 (on-premises) version 9.09.0.0 to before publicationpublicationPatch availableCNA
  • Microsoft Dynamics 365 (on-premises) version 8.2 VendorMicrosoft Affected 8.0 to before publication Fixed in publication Patch available CNA
  • Microsoft Dynamics 365 (on-premises) version 9.0 VendorMicrosoft Affected 9.0.0 to before publication Fixed in publication Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:dynamics_365:8.2:*:*:*:on-premises:*:*:*8.2VulnerableMicrosoft
cpe:2.3:a:microsoft:dynamics_365:9.0:*:*:*:on-premises:*:*:*9.0VulnerableMicrosoft
  • cpe:2.3:a:microsoft:dynamics_365:8.2:*:*:*:on-premises:*:*:* Versions 8.2 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:dynamics_365:9.0:*:*:*:on-premises:*:*:* Versions 9.0 Vulnerable ·Microsoft

Remediation

  • Fix · CNA Microsoft Dynamics 365 (on-premises) version 8.2 (Microsoft) Fixed in publication
  • Fix · CNA Microsoft Dynamics 365 (on-premises) version 9.0 (Microsoft) Fixed in publication

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-16871
  2. 2026-10-03 Alias added: GHSA-g4jp-7cc6-648m

References

Patch 1

  • TI-2018-06256 Improper output encoding in Microsoft Dynamics 365 CVSS 3.0HIGH 8.8
  • TI-2020-12866 Microsoft Dynamics 365 (on-premises) Remote Code Execution Vulnerability CVSS 3.1HIGH 8.8
  • TI-2026-31102 Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.9
  • TI-2024-25464 Microsoft Dynamics 365 Elevation of Privilege Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2022-15512 Microsoft Dynamics CRM (on-premises) Remote Code Execution Vulnerability CVSS 3.1HIGH 8.8
  • TI-2026-35158 Dynamics 365 Elevation of Privilege Vulnerability CVSS 3.1CRITICAL 9.9
See all 102 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences