#VU35714 Input validation error in Team Foundation Server and Azure DevOps Server - CVE-2019-1072

Vulnerability identifier: #VU35714

Vulnerability risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2019-1072

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Team Foundation Server
Server applications / Application servers
Azure DevOps Server
Server applications / Application servers

Vendor: Microsoft

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

A remote code execution vulnerability exists when Azure DevOps Server and Team Foundation Server (TFS) improperly handle user input, aka 'Azure DevOps Server and Team Foundation Server Remote Code Execution Vulnerability'.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Team Foundation Server: 2010 - 2018

Azure DevOps Server: 2010 - 2019.0.1

---

External links
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1072

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.