{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "\u003ca href=\"https://x.com/nmdhkr\"\u003eBrad Schlintz (nmdhkr)\u003c/a\u003e"
        ]
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.microsoft.com/en-us/msrc/security-update-severity-rating-system",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      },
      {
        "category": "general",
        "text": "Required. The vulnerability documented by this CVE requires customer action to resolve.",
        "title": "Customer Action"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2025-62211 Dynamics 365 Field Service (online) Spoofing Vulnerability - HTML",
        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62211"
      },
      {
        "category": "self",
        "summary": "CVE-2025-62211 Dynamics 365 Field Service (online) Spoofing Vulnerability - CSAF",
        "url": "https://msrc.microsoft.com/csaf/advisories/2025/msrc_cve-2025-62211.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Exploitability Index",
        "url": "https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "Dynamics 365 Field Service (online) Spoofing Vulnerability",
    "tracking": {
      "current_release_date": "2025-11-11T08:00:00.000Z",
      "generator": {
        "date": "2025-11-11T17:59:10.379Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2025-62211",
      "initial_release_date": "2025-11-11T08:00:00.000Z",
      "revision_history": [
        {
          "date": "2025-11-11T08:00:00.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c8.8.139.398",
            "product": {
              "name": "Dynamics 365 Field Service (online) \u003c8.8.139.398",
              "product_id": "1"
            }
          },
          {
            "category": "product_version",
            "name": "8.8.139.398",
            "product": {
              "name": "Dynamics 365 Field Service (online) 8.8.139.398",
              "product_id": "20588"
            }
          }
        ],
        "category": "product_name",
        "name": "Dynamics 365 Field Service (online)"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-62211",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "general",
          "text": "Microsoft",
          "title": "Assigning CNA"
        },
        {
          "category": "faq",
          "text": "An authorized attacker must send the user a malicious link and convince the user to open it.",
          "title": "According to the CVSS metric, user interaction is required (UI:R) and privileges required is low (PR:L). What does that mean for this vulnerability?"
        },
        {
          "category": "faq",
          "text": "Customers running Dynamics 365 Field Service (online) need to go to the Power Platform admin center and apply the updates. See Update apps and solutions for more information about updating your Field Service app.",
          "title": "What actions do customers need to take to protect themselves from this vulnerability?"
        },
        {
          "category": "faq",
          "text": "The vulnerability is in the web server, but the malicious scripts execute in the victim\u2019s browser on their machine.",
          "title": "According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?"
        }
      ],
      "product_status": {
        "fixed": [
          "20588"
        ],
        "known_affected": [
          "1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-62211 Dynamics 365 Field Service (online) Spoofing Vulnerability - HTML",
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62211"
        },
        {
          "category": "self",
          "summary": "CVE-2025-62211 Dynamics 365 Field Service (online) Spoofing Vulnerability - CSAF",
          "url": "https://msrc.microsoft.com/csaf/advisories/2025/msrc_cve-2025-62211.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-11-11T08:00:00.000Z",
          "details": "8.8.139.398:Security Update:https://learn.microsoft.com/en-us/dynamics365/field-service/version-history#88139398",
          "product_ids": [
            "1"
          ],
          "url": "https://learn.microsoft.com/en-us/dynamics365/field-service/version-history#88139398"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalsScore": 0.0,
            "exploitCodeMaturity": "UNPROVEN",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "CHANGED",
            "temporalScore": 7.6,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Spoofing"
        },
        {
          "category": "exploit_status",
          "details": "Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Unlikely"
        }
      ],
      "title": "Dynamics 365 Field Service (online) Spoofing Vulnerability"
    }
  ]
}