Main Vulnerability Database Vulnerabilities #VU35714

Input validation error in Team Foundation Server and Azure DevOps Server - CVE-2019-1072

Published: July 15, 2019 / Updated: August 8, 2020

Vulnerability identifier: #VU35714

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-1072

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

A remote code execution vulnerability exists when Azure DevOps Server and Team Foundation Server (TFS) improperly handle user input, aka 'Azure DevOps Server and Team Foundation Server Remote Code Execution Vulnerability'.

Affected software

Team Foundation Server
Azure DevOps Server

How to mitigate CVE-2019-1072

Install update from vendor's website.

External References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1072

Related Security Bulletins