PT-2024-4740 · Microsoft · Azure Devops Server

Felix Boulet · Published 2024-07-09 · Updated 2024-07-17 · CVE-2024-35266

Positive Technologies (AI Summary)

CVSS v2.0

8.7

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:P

Name of the Vulnerable Software and Affected Versions: Azure DevOps Server (affected versions not specified)

Description: The issue is related to the Azure DevOps Server development software and is associated with the failure to take measures to protect the web page structure. Exploitation of this issue may allow a remote attacker to conduct spoofing attacks.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-05260

CVE-2024-35266

Affected Products

Azure Devops Server

References · 5

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35266 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-35266 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05260 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-35266 · Security Note
• https://t.me/cvenotify/86507 · Telegram Post