CVE-2023-21807
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability.
Risk Assessment
An attacker could inject malicious scripts into the application, potentially leading to data theft, session hijacking, or other browser-based attacks.
Recommendation
Apply patches provided by Microsoft for Microsoft Dynamics 365 (on-premises) and consider hardening security configurations.
Other vulnerabilities in Microsoft Dynamics 365
See all- CVE-2026-47647Critical
Improper access control in Microsoft Dynamics 365 allows an authorized attacker to elevate privileges over a network.
- CVE-2026-66301Medium
Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information over a network.
- CVE-2026-65815High
Deserialization of untrusted data in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.
- CVE-2026-40371High
A vulnerability in Microsoft Dynamics 365 (on-premises) related to improper permission handling allows an authorized attacker to elevate privileges over a network.
- CVE-2026-33103Medium
Improper access control in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information locally.
- CVE-2024-43476High
Cross-site Scripting (XSS) vulnerability in Microsoft Dynamics 365 (on-premises). Allows an attacker to inject malicious script into the page.
- CVE-2024-35263Medium
An information disclosure vulnerability in Microsoft Dynamics 365 (On-Premises) allows unauthorized users to access sensitive data. The flaw stems from improper access control management of system resources.
- CVE-2023-21573Medium
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability.
- CVE-2023-21572Medium
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability.
- CVE-2023-21571Medium
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability.
Original NVD description (English source)
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability