CVE-2019-1306Critical
Azure DevOps and Team Foundation Server Remote Code Execution Vulnerability
🔗 CVE IDs covered (1)
📋 Description
A remote code execution vulnerability exists when Azure DevOps Server (ADO) and Team Foundation Server (TFS) fail to validate input properly. An attacker who successfully exploited this vulnerability could execute code on the server in the context of the TFS or ADO service account. To exploit the vulnerability, an attacker would need to upload a specially-crafted file to a vulnerable ADO or TFS server repo and wait for the system to index the file. The security update addresses the vulnerability by correcting how ADO and TFS index files.
🎯 Affected products3
- Azure DevOps Server 2019 Update 1
- Azure DevOps Server 2019.0.1
- Team Foundation Server 2018 Update 3.2
✅ Remediation
KBRelease Notes (Security Update)
🔗 References (7)
- advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-1306
- patchhttp://aka.ms/azdev2019.1patch
- referencehttps://docs.microsoft.com/en-us/azure/devops/server/release-notes/azuredevops2019u1
- patchhttp://aka.ms/azdev2019patch
- referencehttps://docs.microsoft.com/en-us/azure/devops/server/release-notes/azuredevops2019
- patchhttps://aka.ms/tfs2018.3.2patch
- referencehttps://docs.microsoft.com/en-us/visualstudio/releasenotes/tfs2018-update3