First day on Intigriti: our agent harness found and proved a remote code execution bug, paid €3,000.

CVE-2018-8654

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An elevation of privilege vulnerability exists in Microsoft Dynamics 365 Server, aka 'Microsoft Dynamics 365 Elevation of Privilege Vulnerability'.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
Microsoft	Microsoft Dynamics 365 (on-premises) version 8	unspecified

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8654Patch, Vendor Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8654Patch, Vendor Advisory

Timeline

Published: Jan 24, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-87109.8A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrate CVE-2018-87119.8A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated CVE-2018-87129.8An issue was discovered in Webmin 1.840 and 1.880 when the default Yes setting of "Can view any file as a log file" is enabled. As a result CVE-2018-87146.1Honeywell MatrikonOPC OPC Controller before 5.1.0.0 allows local users to transfer arbitrary files from a host computer and consequently obt CVE-2018-87158.1The Embedthis HTTP library, and Appweb versions before 7.0.3, have a logic flaw related to the authCondition function in http/httpLib.c. Wit CVE-2018-87165.4WSO2 Identity Server before 5.5.0 has XSS via the dashboard, allowing attacks by low-privileged attackers.CVE-2018-87178.8joyplus-cms 1.6.0 has CSRF, as demonstrated by adding an administrator account via a manager/admin_ajax.php?action=save&tab={pre}manager req CVE-2018-87188.0Cross-site request forgery (CSRF) vulnerability in the Mailer Plugin 1.20 for Jenkins 2.111 allows remote authenticated users to send unauth CVE-2018-87195.3An issue was discovered in the WP Security Audit Log plugin 3.1.1 for WordPress. Access to wp-content/uploads/wp-security-audit-log/* files CVE-2018-87205.4ServiceNow ITSM 2016-06-02 has XSS via the First Name or Last Name field of My Profile (aka navpage.do), or the Search bar of My Portal (aka CVE-2018-87216.1Zoho ManageEngine EventLog Analyzer version 11.0 build 11000 has Stored XSS related to the index2.do?url=editAlertForm&tab=alert&alert=profi CVE-2018-87226.1Zoho ManageEngine Desktop Central version 9.1.0 build 91099 has multiple XSS issues that were fixed in build 92026.