CVE-2020-1018

Microsoft Dynamics Business Central/NAV Information Disclosure

CVE-2020-1018 is fixed in 6 products on 1 platform, first by KB4549677, released April 14, 2020. It is not reported as exploited. Patch Radar priority: High.

High
CVSS
n/a
Important
Exploitation
None reported
Exploitation Less Likely
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0631
93rd percentile

<p>An information disclosure vulnerability exists when Microsoft Dynamics Business Central/NAV on-premise does not properly hide the value of a masked field when showing the records as a chart page.</p> <p>The attacker who successfully exploited the vulnerability could see the information that are in a masked field.</p> <p>The security update addresses the vulnerability by updating the rendering engine the Windows client to properly detect masked fields and render the content as masked.</p>

Where it's fixed

ProductFixed inFixReleased
Microsoft
Dynamics 365 Business Central Spring 2019 Update KB4549677 Apr 14, 2020
Microsoft Dynamics 365 BC On Premise KB4549676 Apr 14, 2020
Microsoft Dynamics NAV 2015 KB4557700 Apr 14, 2020
Microsoft Dynamics NAV 2016 KB4549673 Apr 14, 2020
Microsoft Dynamics NAV 2017 KB4549674 Apr 14, 2020
Microsoft Dynamics NAV 2018 KB4549675 Apr 14, 2020