A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0979.

The Microsoft Team Foundation Server or Azure DevOps Server is missing security updates. It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists when     Azure DevOps Server and Microsoft Team Foundation Server     do not properly sanitize a specially crafted     authentication request to an affected server. An     attacker who successfully exploited this vulnerability     could execute malicious code on a vulnerable server.
    (CVE-2019-0971)

  - A Cross-site Scripting (XSS) vulnerability exists when     Azure DevOps Server and Team Foundation Server does not     properly sanitize user provided input. An authenticated     attacker could exploit the vulnerability by sending a     specially crafted payload to an Azure DevOps server or a     Team Foundation server, which will get executed in the     context of the user every time a user visits the     compromised page. The attacker who successfully     exploited the vulnerability could then perform cross-     site scripting attacks on affected systems and run     script in the security context of the current user. The     attacks could allow the attacker to read content that     the attacker is not authorized to read, execute     malicious code, and use the victim's identity to take     actions on the site on behalf of the user, such as     change permissions and delete content. The security     update addresses the vulnerability by ensuring that     Azure DevOps Server and Team Foundation Server properly     sanitizes user input. (CVE-2019-0872, CVE-2019-0979)

Detections

Analytics

CVE-2019-0872

medium

Tenable Plugins

medium