Azure DevOps Server Remote Code Execution Vulnerability
CVE-2023-36437

8.8HIGH

Key Information:

Vendor

Microsoft
Status
Azure Pipelines Agent
Vendor
CVE Published:
14 November 2023

What is CVE-2023-36437?

The Azure DevOps Server is susceptible to a remote code execution vulnerability that allows attackers to execute arbitrary code by exploiting improper validation of input. This security flaw could lead to unauthorized actions on the server, compromising data integrity and system infrastructure. Organizations using Azure DevOps Server should immediately assess their systems and apply necessary security measures to mitigate any potential risks associated with this vulnerability.

Affected Version(s)

Azure Pipelines Agent Unknown 1.0.0 < 2.39.1

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisory

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.