Azure DevOps Server Remote Code Execution Vulnerability
🔗 CVE IDs covered (1)
📋 Description
What privileges could be gained by an attacker who successfully exploited the vulnerability? An attacker who successfully exploited this vulnerability could gain administrator privileges.
According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires an attacker to gather information specific to the environment and take additional actions prior to exploitation to prepare the target environment.
🎯 Affected products5
- Azure DevOps Server 2019.0.1
- Azure DevOps Server 2019.1.2
- Azure DevOps Server 2020.0.2
- Azure DevOps Server 2020.1.2
- Azure DevOps Server 2022.0.1
✅ Remediation
KBRelease Notes (Security Update) — fixed build 20230601.3 KBRelease Notes (Security Update) — fixed build 20230825.4 KBRelease Notes (Security Update) — fixed build 20230823.1 KBRelease Notes (Security Update) — fixed build 20230825.1 KBRelease Notes (Security Update) — fixed build 20230820.2
🔗 References (6)
- advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38155
- referencehttps://learn.microsoft.com/en-us/azure/devops/server/release-notes/azuredevops2019?view=azure-devops
- referencehttps://learn.microsoft.com/azure/devops/server/release-notes/azuredevops2022?view=azure-devops
- referencehttps://learn.microsoft.com/en-us/azure/devops/server/release-notes/azuredevops2020u1?view=azure-devops
- referencehttps://learn.microsoft.com/en-us/azure/devops/server/release-notes/azuredevops2019u1?view=azure-devops
- referencehttps://learn.microsoft.com/en-us/azure/devops/server/release-notes/azuredevops2020?view=azure-devops