CVE-2019-1072

A remote code execution vulnerability exists when Azure DevOps Server and Team Foundation Server (TFS) improperly handle user input, aka 'Azure DevOps Server and Team Foundation Server Remote Code Execution Vulnerability'.

Score

CVSS 3.0 9.8 Critical

Status

Modified - secure@microsoft.com

Published

2019-07-15

Last modified

2024-08-04

Weaknesses

CWE-20

Affected products

• Azure Devops Server (Microsoft)
• Team Foundation Server (Microsoft)
• Team Foundation Server 2010 (Microsoft)
• Team Foundation Server 2012 (Microsoft)
• Team Foundation Server 2013 Update 5 (Microsoft)
• Team Foundation Server 2015 (Microsoft)
• Team Foundation Server 2018 (Microsoft)

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1072