Improper input validation in Microsoft Azure Devops Server
CVE-2019-1306
A remote code execution vulnerability exists when Azure DevOps Server (ADO) and Team Foundation Server (TFS) fail to validate input properly, aka 'Azure DevOps and Team Foundation Server Remote Code Execution Vulnerability'.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.159 (96.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Microsoft Azure Devops Server — versions 2019.0.1
- Microsoft Azure_devops_server — versions 2019, 2019.0.1
- Microsoft Azure Devops Server 2019 Update 1 — versions unspecified
- Microsoft Team_foundation_server — versions 2018
- Microsoft Team Foundation Server 2018 — versions Update 3.2
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secure@microsoft.com (Patch, x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2019-1306?
- CVE-2019-1306 is a critical-severity vulnerability in Microsoft Azure Devops Server, classified under Improper Input Validation. CVSS score: 9.8/10. Published 2019-09-11.
- How severe is CVE-2019-1306?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2019-1306 known to be exploited?
- 24 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.