Read the docs
TI-2020-13107 Aliases CVE-2020-17133GHSA-48m9-cmgj-94xc

Microsoft Dynamics Business Central/NAV Information Disclosure Vulnerability

Priority LOW 35Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Microsoft Dynamics Business Central/NAV Information Disclosure Vulnerability

Why it matters now

EPSS 0.03843 90th percentileScored 2026-11-07
Fix Fixed Microsoft Dynamics NAV 2015 (Microsoft): publication

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftMicrosoft Dynamics NAV 20151.0 to before publicationpublicationPatch availableCNA
  • Microsoft Dynamics NAV 2015 VendorMicrosoft Affected 1.0 to before publication Fixed in publication Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:dynamics_nav:2015:*:*:*:*:*:*:*2015VulnerableMicrosoft
  • cpe:2.3:a:microsoft:dynamics_nav:2015:*:*:*:*:*:*:* Versions 2015 Vulnerable ·Microsoft

Remediation

  • Fix · CNA Microsoft Dynamics NAV 2015 (Microsoft) Fixed in publication

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-17133
  2. 2026-10-03 Alias added: GHSA-48m9-cmgj-94xc
  3. 2026-10-19 EPSS moved to the 90th–95th percentile

References

Patch 2

  • TI-2026-40350 Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2020-00875 An remote code execution vulnerability exists in Microsoft Dynamics Business Central, aka… CVSS 3.1HIGH 8.0
  • TI-2020-00991 A remote code execution vulnerability exists in Microsoft Dynamics Business Central, aka… CVSS 3.1HIGH 8.0
  • TI-2020-00987 Information disclosure in Microsoft Dynamics NAV 2016 CVSS 3.1HIGH 7.5
  • TI-2022-19648 Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability CVSS 3.1HIGH 8.5
  • TI-2021-01440 Microsoft Dynamics Business Central Cross-site Scripting Vulnerability CVSS 3.1MEDIUM 6.1
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences