Un Authenticated Attacker Can Trick Users to Click on Spoofing Links

CVE-2024-38166

What is CVE-2024-38166?

A cross-site scripting vulnerability exists in Microsoft Dynamics 365 that allows attackers to exploit improper input handling during web page generation. By crafting a malicious link, an unauthenticated attacker can deceive a user into clicking on it, potentially compromising user interactions with the application. This could lead to unauthorized actions by exploiting the trust of the user in the affected product. Implementing proper input validation and user education can help mitigate the risks associated with this vulnerability.

References