CVE-2024-38166

An unauthenticated attacker can exploit improper neutralization of input during web page generation in Microsoft Dynamics 365 to spoof over a network by tricking a user to click on a link.

Score

CVSS 3.1 8.2 High

Status

Modified - secure@microsoft.com

Published

2024-08-06

Last modified

2025-07-10

Weaknesses

CWE-79

Affected products

• Dynamics Crm Service Portal Web Resource (Microsoft)

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38166