CVE-2020-1018 Information disclosure in Dynamics 365 Business Central 2019 Spring Update

High 7.5 Published 15 Apr 2020 Updated 4 Aug 2024

Attackers can view masked field values in chart pages of Microsoft Dynamics Business Central/NAV on-premise, exposing sensitive data.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-1018?

CVE-2020-1018 is a high-severity vulnerability in Microsoft Dynamics 365 Business Central 2019 Spring Update, published on 15 Apr 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An information disclosure vulnerability exists when Microsoft Dynamics Business Central/NAV on-premise does not properly hide the value of a masked field when showing the records as a chart page.The attacker who successfully exploited the vulnerability could see the information that are in a masked field.The security update addresses the vulnerability by updating the rendering engine the Windows client to properly detect masked fields and render the content as masked., aka 'Microsoft Dynamics Business Central/NAV Information Disclosure'.

Weakness: CWE-200

Which versions are affected by CVE-2020-1018?

It affects 2 products.

Products include Microsoft Dynamics 365 Business Central, Microsoft Dynamics Nav.

How do I fix CVE-2020-1018?

No fix has been published for CVE-2020-1018 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-1018 being exploited?

There is no known exploitation of CVE-2020-1018 in the wild and no public exploit code.

Sources

Also known as GHSA-4hf4-8q97-rmrh.