CVE-2019-1072

Опубликовано: 09 июл. 2019

Источник: msrc

EPSS Средний

Описание

Azure DevOps Server and Team Foundation Server Remote Code Execution Vulnerability

A remote code execution vulnerability exists when Azure DevOps Server and Team Foundation Server (TFS) improperly handle user input. An attacker who successfully exploited the vulnerability could execute code on the target server in the context of the DevOps or TFS service account.

To exploit the vulnerability, an attacker could submit a specially crafted file to an affected server. If anonymous access is allowed to projects on an affected server, the attacker would not require authentication.

The update corrects the way that DevOps Server and TFS process certain file types.

Обновления

Продукт	Статья	Обновление
Team Foundation Server 2012 Update 4	Release Notes Release Notes Release Notes Release Notes Release Notes Release Notes Release Notes Release Notes Release Notes	Security Update Security Update Security Update Security Update Security Update Security Update Security Update Security Update Security Update
Team Foundation Server 2013 Update 5	Release Notes Release Notes Release Notes Release Notes Release Notes Release Notes Release Notes Release Notes Release Notes	Security Update Security Update Security Update Security Update Security Update Security Update Security Update Security Update Security Update
Team Foundation Server 2017 Update 3.1	Release Notes Release Notes Release Notes Release Notes Release Notes Release Notes Release Notes Release Notes Release Notes	Security Update Security Update Security Update Security Update Security Update Security Update Security Update Security Update Security Update
Team Foundation Server 2018 Update 1.2	Release Notes Release Notes Release Notes Release Notes Release Notes Release Notes Release Notes Release Notes Release Notes	Security Update Security Update Security Update Security Update Security Update Security Update Security Update Security Update Security Update
Team Foundation Server 2018 Update 3.2	Release Notes Release Notes Release Notes Release Notes Release Notes Release Notes Release Notes Release Notes Release Notes	Security Update Security Update Security Update Security Update Security Update Security Update Security Update Security Update Security Update
Team Foundation Server 2015 Update 4.2	Release Notes Release Notes Release Notes Release Notes Release Notes Release Notes Release Notes Release Notes Release Notes	Security Update Security Update Security Update Security Update Security Update Security Update Security Update Security Update Security Update
Azure DevOps Server 2019.0.1	Release Notes Release Notes Release Notes Release Notes Release Notes Release Notes Release Notes Release Notes Release Notes	Security Update Security Update Security Update Security Update Security Update Security Update Security Update Security Update Security Update
Team Foundation Server 2010 SP1 (x86)	Release Notes Release Notes Release Notes Release Notes Release Notes Release Notes Release Notes Release Notes Release Notes	Security Update Security Update Security Update Security Update Security Update Security Update Security Update Security Update Security Update
Team Foundation Server 2010 SP1 (x64)	Release Notes Release Notes Release Notes Release Notes Release Notes Release Notes Release Notes Release Notes Release Notes	Security Update Security Update Security Update Security Update Security Update Security Update Security Update Security Update Security Update

Показывать по

Возможность эксплуатации

Publicly Disclosed

Exploited

Latest Software Release

Exploitation Less Likely

Older Software Release

Exploitation Less Likely

DOS

N/A

EPSS

Процентиль: 96%

0.24111

Средний

Связанные уязвимости

CVE-2019-1072

CVSS3: 9.8

nvd

больше 6 лет назад

A remote code execution vulnerability exists when Azure DevOps Server and Team Foundation Server (TFS) improperly handle user input, aka 'Azure DevOps Server and Team Foundation Server Remote Code Execution Vulnerability'.

GHSA-g5c6-v9ph-hmxh

CVSS3: 9.8

github

больше 3 лет назад

BDU:2019-02589

CVSS3: 9.8

fstec

больше 6 лет назад

Уязвимость набора средств разработки программного обеспечения для совместной работы Azure DevOps Server и системы управления проектами и контроля версий Team Foundation Server, связанная с недостаточной проверкой входных данных, позволяющая нарушителю выполнить произвольный код

EPSS

Процентиль: 96%

0.24111

Средний