Skip to content
OpenAdvisories
Medium · 6.5 CVE-2020-16943 EUVD-2020-8901GHSA-cwwh-8p3m-623m

Dynamics 365 Commerce Elevation of Privilege Vulnerability

Published Oct 16, 2020 · Updated Nov 15, 2024 · Assigned by microsoft

Description

<p>An elevation of privilege vulnerability exists in Microsoft Dynamics 365 Commerce. An unauthenticated attacker who successfully exploited this vulnerability could update data without proper authorization.</p>
<p>To exploit the vulnerability, an attacker would need to send a specially crafted request to an affected server.</p>
<p>The security update addresses the vulnerability by correcting how Microsoft Dynamics 365 Commerce performs authorization checks.</p>

Affected products

VendorProductAffectedFixed
Microsoft Dynamics 365 Commerce version 10.0.12 10.0.0 – < publication publication
Microsoft Dynamics 365 Commerce version 10.0.13 10.0.0 – < publication publication
Microsoft Dynamics 365 Commerce version 10.0.14 10.0.0 – < publication publication
Microsoft Dynamics 365 Commerce version 10.0.15 10.0.0 – < publication publication
Microsoft Dynamics 365 Commerce version 10.0.16 10.0.0 – < publication publication

References