CVE-2023-36437

FAQ

How could an attacker exploit this vulnerability?

An attacker could exploit an integer overflow vulnerability that results in arbitrary heap writes, which could be used to perform arbitrary code execution.

According to the CVSS metric, privileges required is low (PR:L). Does the attacker need to be in an authenticated role on ADO?

Yes, the attacker needs to be authenticated to Azure DevOps server.