CVE-2024-38166CWE-79

Microsoft Dynamics 365 Cross-site Scripting Vulnerability

High · published August 6, 2024

CVSS v3.1
8.2
EPSS
1%
Percentile
54.4
In the wild
Unconfirmed
What it is

An unauthenticated attacker can exploit improper neutralization of input during web page generation in Microsoft Dynamics 365 to spoof over a network by tricking a user to click on a link.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.00750 · 54.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-08-06T21:38Z
EPSS history
Timeline
  • 06 AUG 21:38Z
    Microsoft Dynamics 365 Cross-site Scripting Vulnerability
    cvelistv5