Microsoft Dynamics 365 Online
Monthly
Server-side request forgery in Microsoft Dynamics 365 (Online) lets a remote, unauthenticated attacker coerce the cloud service into issuing crafted requests to perform network spoofing, with the CVSS 3.1 score of 9.3 driven by a scope change (S:C) and high confidentiality and integrity impact. Because Dynamics 365 (Online) is a Microsoft-hosted SaaS, exploitation requires victim user interaction (UI:R) and the fix is applied server-side by the vendor. There is no public exploit identified at time of analysis, EPSS is very low (0.04%, 13th percentile), and CISA SSVC scores exploitation as 'none', indicating no observed in-the-wild activity despite the high base score.
Server-side request forgery in Microsoft Dynamics 365 (Online) lets a remote, unauthenticated attacker coerce the cloud service into issuing crafted requests to perform network spoofing, with the CVSS 3.1 score of 9.3 driven by a scope change (S:C) and high confidentiality and integrity impact. Because Dynamics 365 (Online) is a Microsoft-hosted SaaS, exploitation requires victim user interaction (UI:R) and the fix is applied server-side by the vendor. There is no public exploit identified at time of analysis, EPSS is very low (0.04%, 13th percentile), and CISA SSVC scores exploitation as 'none', indicating no observed in-the-wild activity despite the high base score.