CVE-2020-1049

CVE-2020-1049 describes a cross-site scripting (XSS) vulnerability in Microsoft Dynamics 365 (on-premises) that arises from insufficient sanitization of specially crafted web requests. This flaw could allow an attacker to inject malicious scripts into affected Dynamics servers. Rated with a CVSS score of 5.4 (Medium), the vulnerability requires user interaction (UI:R) and low privileges (PR:L) for exploitation over a network (AV:N). Successful exploitation could lead to limited confidentiality and integrity impacts (C:L/I:L), but not availability (A:N). There is no evidence of active exploitation, and no public exploit code is available via Metasploit, Nuclei, or ExploitDB. While it received limited community discussion and media coverage at the time of its disclosure, its EPSS score indicates a very low probability of exploitation.