CVE-2020-1018
Microsoft Dynamics Business Central/NAV Information Disclosure
CVE-2020-1018 is fixed in 6 products on 1 platform, first by KB4549677, released April 14, 2020. It is not reported as exploited. Patch Radar priority: High.
High
CVSS
n/a
Important
Exploitation
None reported
Exploitation Less Likely
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0631
93rd percentile
<p>An information disclosure vulnerability exists when Microsoft Dynamics Business Central/NAV on-premise does not properly hide the value of a masked field when showing the records as a chart page.</p> <p>The attacker who successfully exploited the vulnerability could see the information that are in a masked field.</p> <p>The security update addresses the vulnerability by updating the rendering engine the Windows client to properly detect masked fields and render the content as masked.</p>
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Microsoft | |||
| Dynamics 365 Business Central Spring 2019 Update | KB4549677 | Apr 14, 2020 | |
| Microsoft Dynamics 365 BC On Premise | KB4549676 | Apr 14, 2020 | |
| Microsoft Dynamics NAV 2015 | KB4557700 | Apr 14, 2020 | |
| Microsoft Dynamics NAV 2016 | KB4549673 | Apr 14, 2020 | |
| Microsoft Dynamics NAV 2017 | KB4549674 | Apr 14, 2020 | |
| Microsoft Dynamics NAV 2018 | KB4549675 | Apr 14, 2020 | |