CVE-2019-1072

9.8CRITICAL

Key Information:

Vendor: Microsoft
Status: Team Foundation Server 2012; Team Foundation Server 2013 Update 5; Team Foundation Server 2018; Team Foundation Server
Vendor: CVE Published:; 15 July 2019

Summary

A remote code execution vulnerability exists when Azure DevOps Server and Team Foundation Server (TFS) improperly handle user input, aka 'Azure DevOps Server and Team Foundation Server Remote Code Execution Vulnerability'.

Affected Version(s)

Azure DevOps Server 2019.0.1

Team Foundation Server 2017 Update 3.1

Team Foundation Server 2010 SP1 (x86)

References

https://portal.msrc.microsoft.com/en-US/security-guidance...

x_refsource_MISC

EPSS Score

3% chance of being exploited in the next 30 days.

CVSS V3.1

Score:

9.8

Severity:

CRITICAL

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published
Jul 15, 2019
Vulnerability Reserved
Nov 26, 2018

Collectors

NVD DatabaseMitre Database