Product:
Dynamics 365 Field Service
Summary
Improper neutralization of input during web page generation allows an authorized attacker to perform spoofing over a network. This vulnerability can lead to significant security risks, including unauthorized access and data manipulation. It is crucial for users to be aware of this issue to protect their systems.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.7 | CVE-2025-62210 |
Exploitation
To exploit this vulnerability, an attacker must have authorized access to the Dynamics 365 Field Service application. By crafting malicious input that is improperly handled during web page generation, the attacker can execute cross-site scripting attacks. This can lead to the execution of arbitrary scripts in the context of the user’s session, allowing the attacker to spoof user actions or steal sensitive information.
Affected Products
- Dynamics 365 Field Service (online) – A cloud-based service that allows organizations to manage field service operations.
Mitigation
To mitigate this vulnerability, it is recommended that users apply the latest security updates provided by Microsoft. Additionally, organizations should implement input validation and output encoding practices to prevent cross-site scripting attacks. Regular security assessments and user training can also help in reducing the risk of exploitation.