CVE-2024-38166

High

Description

An unauthenticated attacker can exploit improper neutralization of input during web page generation in Microsoft Dynamics 365 to spoof over a network by tricking a user to click on a link.

SeverityHigh

CVSS8.2

Exploit probability—

Product

Microsoft Dynamics Crm Service Portal Web Resource

PublishedAug 6, 2024

First seenAug 6, 2024

Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Vendor advisories

msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38166

Affected products

Product	Affected versions	Fixed in
microsoft dynamics_crm_service_portal_web_resource	No range specified	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.