CVE-2020-17133: 
vulnerability analysis and mitigation

Microsoft Dynamics Business Central/NAV Information Disclosure vulnerability (CVE-2020-17133) affects Microsoft Dynamics NAV 2015 and Microsoft Dynamics NAV 2013 R2. The vulnerability was discovered when it was found that the Password field in the Document Service table was not properly masked, making it visible during inspection (Microsoft Support).

The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. This indicates that the vulnerability can be exploited over the network, requires low attack complexity, needs low privileges, requires no user interaction, and can result in high confidentiality impact but no integrity or availability impact (NVD).

The primary impact of this vulnerability is the potential exposure of sensitive information due to the unmasked password field in the Document Service table. This could lead to unauthorized access to system resources if the exposed credentials are discovered (Microsoft Support).

Microsoft has released security packages to address this vulnerability. Organizations running affected versions should install the appropriate package: Package for Microsoft Dynamics NAV 2015 or Package for Microsoft Dynamics NAV 2013 R2 (Microsoft Support).