Microsoft Dynamics 365 Field Service Cross-Site Scripting Vulnerability Allowing Spoofing

A cross-site scripting vulnerability has been identified in Microsoft Dynamics 365 Field Service (online). This issue arises from improper input neutralization during web page generation, allowing an authorized attacker to perform spoofing over the network. The vulnerability affects several different versions and ranges of the application.

Impact

Exploitation of this vulnerability could lead to spoofing, with malicious scripts executing in the context of the victim's browser.

Remediation

Customers using Dynamics 365 Field Service (online) should visit the Power Platform admin center to apply the necessary updates. More information on updating the Field Service app can be found in the release notes.