High severity · published Apr 15, 2020
CVE-2020-1018
An information disclosure vulnerability exists when Microsoft Dynamics Business Central/NAV on-premise does not properly hide the value of a masked field when showing the records…
7.5
CVSS
6.3%
EPSS
No
On KEV
Description
An information disclosure vulnerability exists when Microsoft Dynamics Business Central/NAV on-premise does not properly hide the value of a masked field when showing the records as a chart page.The attacker who successfully exploited the vulnerability could see the information that are in a masked field.The security update addresses the vulnerability by updating the rendering engine the Windows client to properly detect masked fields and render the content as masked., aka 'Microsoft Dynamics Business Central/NAV Information Disclosure'.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)6.3% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DN
Dynamics Nav · Microsoft
2015; 2016; 2017; 2018 · source: NVD
Affected product
D3
Dynamics 365 Business Central
Microsoft
More from Dynamics 365 Business Central
9.8
CVE-2024-38225
Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
8.8
CVE-2024-43460
Improper authorization in Dynamics 365 Business Central resulted in a vulnerability that allows an authenticated attacker to elevate privileges over a network
8.8
CVE-2024-35249
Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability
8.5
CVE-2022-41127
Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability
8.0
CVE-2024-21380
Microsoft Dynamics Business Central/NAV Information Disclosure Vulnerability