Elevation of Privilege in Azure DevOps Server and Team Foundation Services
CVE-2020-0815

7.5HIGH

Key Information:

Vendor
Microsoft
Status
Azure Devops Server 2019 Update 1.1
Vendor
CVE Published:
12 March 2020

Summary

An elevation of privilege vulnerability exists within Azure DevOps Server and Team Foundation Services due to improper handling of pipeline job tokens. This could allow an attacker to gain elevated permissions, potentially leading to unauthorized access to sensitive functions and data. Organizations utilizing these services should ensure they remain updated to mitigate the risks associated with this vulnerability.

Affected Version(s)

Azure DevOps Server 2019 Update 1.1 = unspecified

References

https://portal.msrc.microsoft.com/en-US/security-guidance...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.