PT-2019-2710 · Microsoft · Azure Devops Server+1

Publicado 2019-07-09 · Atualizado 2019-07-18 · CVE-2019-1076

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Team Foundation Server (affected versions not specified)

Description A Cross-site Scripting (XSS) issue exists due to improper sanitization of user-provided input. This could allow a remote attacker to execute arbitrary code in the context of the current user by sending a specially crafted request to the Team Foundation Server. The vulnerability is related to the lack of input data sanitization measures in the Azure DevOps Server and Team Foundation Server collaborative software development toolkit and project management and version control system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2019-02646

CVE-2019-1076

Produtos afetados

Azure Devops Server

Team Foundation Server

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-1076 · Nota de Segurança
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1076 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-1076 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-02646 · Nota de Segurança