What is CVE-2023-21751?

CVE-2023-21751 is a security advisory published by Microsoft Security Response Center (MSRC) with High severity. Azure DevOps Server Spoofing Vulnerability

Which CVE IDs does CVE-2023-21751 cover?

CVE-2023-21751 covers the following CVE IDs: CVE-2023-21751. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of CVE-2023-21751?

CVE-2023-21751 has a CVSS v3 base score of 6.5, published by Microsoft Security Response Center (MSRC).

Which products are affected by CVE-2023-21751?

CVE-2023-21751 affects 2 products, including: Azure DevOps Server 2020.1.2; Azure DevOps Server 2022.1.

CVE-2023-21751HighCVSS 6.5

Azure DevOps Server Spoofing Vulnerability

Vendor

Microsoft Security Response Center (MSRC)

Published

December 13, 2023

Last Modified

—

🔗 CVE IDs covered (1)

CVE-2023-21751 →

📋 Description

According to the CVSS metric,privileges required is low(PR:L). What does that mean for this vulnerability? This means that an attacker needs to have a user account in the organization with the ability to run builds.

According to the CVSS metric, successful exploitation of this vulnerability could impact the integrity(I:H). What does that mean for this vulnerability? Successful exploitation compromises the integrity of the build verification process, allowing an attacker to spoof and bypass verification.

🎯 Affected products2

Azure DevOps Server 2020.1.2
Azure DevOps Server 2022.1

✅ Remediation

KBRelease Notes (Security Update) — fixed build 20231128.1 KBRelease Notes (Security Update) — fixed build 20231127.4

🔗 References (1)

advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21751