An information disclosure vulnerability exists when Microsoft Dynamics Business Central/NAV on-premise does not properly hide the value of a masked field when showing the records as a chart page.The attacker who successfully exploited the vulnerability could see the information that are in a masked field.The security update addresses the vulnerability by updating the rendering engine the Windows client to properly detect masked fields and render the content as masked., aka 'Microsoft Dynamics Business Central/NAV Information Disclosure'.

The Microsoft Dynamics NAV install is missing a security update. It is, therefore, affected by the following vulnerabilities :

  - An information disclosure vulnerability exists in Dynamics NAV due to the application not properly hiding     the value of a masked field when showing the records as a chart page. An unauthenticated, remote attacker     can exploit this to disclose potentially sensitive information. (CVE-2020-1018)

  - A remote code execution vulnerability exists in Dynamics NAV due to an unspecified reason. An     authenticated, remote attacker can exploit this by convincing a user to connect to a malicious Dynamics     Business Central client to execute arbitrary commands. (CVE-2020-1022)

Note that Nessus has not attempted to exploit this issue but has instead relied only on the application's self-reported version number.

The Microsoft Dynamics 365 Business Central install is missing a security update. It is, therefore, affected by a the following vulnerabilities :

  - An information disclosure vulnerability exists in Business Central due to the application not properly     hiding the value of a masked field when showing the records as a chart page. An unauthenticated, remote     attacker can exploit this to disclose potentially sensitive information. (CVE-2020-1018)

  - A remote code execution vulnerability exists in Business Central due to an unspecified reason. An     authenticated, remote attacker can exploit this by convincing a user to connect to a malicious Dynamics     Business Central client to execute arbitrary commands. (CVE-2020-1022)

Note that Nessus has not attempted to exploit this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
136474	Security Updates for Microsoft Dynamics NAV (Apr 2020)	Nessus	Windows : Microsoft Bulletins	high
136425	Security Updates for Microsoft Dynamics 365 Business Central (Apr 2020)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2020-1018

high

Tenable Plugins

high

high