cnvd - cnvd-2019-09618

cnvd-2019-09618

Vulnerability from cnvd

Title: Azure DevOps Server和Team Foundation Server跨站脚本漏洞

Description:

Azure DevOps Server原名Team Foundation Server (TFS)，是本地托管的一组协作式软件开发工具。Azure DevOps Server与现有IDE或编辑器集成，可使跨职能团队有效处理各种规模的项目。Team Foundation Server是Microsoft产品，提供源代码管理、报告、需求管理、项目管理、自动构建、实验室管理、测试及发布管理功能。

Azure DevOps Server和Team Foundation Server存在跨站脚本漏洞。该漏洞源于这两款产品未能正确验证用户提供的输入。攻击者可利用该漏洞进行跨站脚本攻击，从而可在当前用户的安全上下文中运行脚本。

Severity: 中

Patch Name: Azure DevOps Server和Team Foundation Server跨站脚本漏洞的补丁

Patch Description:

Azure DevOps Server和Team Foundation Server存在跨站脚本漏洞。该漏洞源于这两款产品未能正确验证用户提供的输入。攻击者可利用该漏洞进行跨站脚本攻击，从而可在当前用户的安全上下文中运行脚本。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布漏洞修复程序，请及时关注更新： https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0866

Reference: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0866

Impacted products

Name
['Microsoft Azure DevOps Server 2019', 'Microsoft Team Foundation Server 2018 Update 3.2', 'Microsoft Team Foundation Server 2018 Update 1.2', 'Microsoft Team Foundation Server 2017 Update 3.1', 'Microsoft Team Foundation Server 2015 Update 4.2']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-0866"
    }
  },
  "description": "Azure DevOps Server\u539f\u540dTeam Foundation Server (TFS)\uff0c\u662f\u672c\u5730\u6258\u7ba1\u7684\u4e00\u7ec4\u534f\u4f5c\u5f0f\u8f6f\u4ef6\u5f00\u53d1\u5de5\u5177\u3002Azure DevOps Server\u4e0e\u73b0\u6709IDE\u6216\u7f16\u8f91\u5668\u96c6\u6210\uff0c\u53ef\u4f7f\u8de8\u804c\u80fd\u56e2\u961f\u6709\u6548\u5904\u7406\u5404\u79cd\u89c4\u6a21\u7684\u9879\u76ee\u3002Team Foundation Server\u662fMicrosoft\u4ea7\u54c1\uff0c\u63d0\u4f9b\u6e90\u4ee3\u7801\u7ba1\u7406\u3001\u62a5\u544a\u3001\u9700\u6c42\u7ba1\u7406\u3001\u9879\u76ee\u7ba1\u7406\u3001\u81ea\u52a8\u6784\u5efa\u3001\u5b9e\u9a8c\u5ba4\u7ba1\u7406\u3001\u6d4b\u8bd5\u53ca\u53d1\u5e03\u7ba1\u7406\u529f\u80fd\u3002\n\nAzure DevOps Server\u548cTeam Foundation Server\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u8fd9\u4e24\u6b3e\u4ea7\u54c1\u672a\u80fd\u6b63\u786e\u9a8c\u8bc1\u7528\u6237\u63d0\u4f9b\u7684\u8f93\u5165\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u8fdb\u884c\u8de8\u7ad9\u811a\u672c\u653b\u51fb\uff0c\u4ece\u800c\u53ef\u5728\u5f53\u524d\u7528\u6237\u7684\u5b89\u5168\u4e0a\u4e0b\u6587\u4e2d\u8fd0\u884c\u811a\u672c\u3002",
  "discovererName": "Mikhail Shcherbakov of KTH Royal Institute of Technology",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0866",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-09618",
  "openTime": "2019-04-11",
  "patchDescription": "Azure DevOps Server\u539f\u540dTeam Foundation Server (TFS)\uff0c\u662f\u672c\u5730\u6258\u7ba1\u7684\u4e00\u7ec4\u534f\u4f5c\u5f0f\u8f6f\u4ef6\u5f00\u53d1\u5de5\u5177\u3002Azure DevOps Server\u4e0e\u73b0\u6709IDE\u6216\u7f16\u8f91\u5668\u96c6\u6210\uff0c\u53ef\u4f7f\u8de8\u804c\u80fd\u56e2\u961f\u6709\u6548\u5904\u7406\u5404\u79cd\u89c4\u6a21\u7684\u9879\u76ee\u3002Team Foundation Server\u662fMicrosoft\u4ea7\u54c1\uff0c\u63d0\u4f9b\u6e90\u4ee3\u7801\u7ba1\u7406\u3001\u62a5\u544a\u3001\u9700\u6c42\u7ba1\u7406\u3001\u9879\u76ee\u7ba1\u7406\u3001\u81ea\u52a8\u6784\u5efa\u3001\u5b9e\u9a8c\u5ba4\u7ba1\u7406\u3001\u6d4b\u8bd5\u53ca\u53d1\u5e03\u7ba1\u7406\u529f\u80fd\u3002\r\n\r\nAzure DevOps Server\u548cTeam Foundation Server\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u8fd9\u4e24\u6b3e\u4ea7\u54c1\u672a\u80fd\u6b63\u786e\u9a8c\u8bc1\u7528\u6237\u63d0\u4f9b\u7684\u8f93\u5165\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u8fdb\u884c\u8de8\u7ad9\u811a\u672c\u653b\u51fb\uff0c\u4ece\u800c\u53ef\u5728\u5f53\u524d\u7528\u6237\u7684\u5b89\u5168\u4e0a\u4e0b\u6587\u4e2d\u8fd0\u884c\u811a\u672c\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Azure DevOps Server\u548cTeam Foundation Server\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Microsoft Azure DevOps Server 2019",
      "Microsoft Team Foundation Server 2018 Update 3.2",
      "Microsoft Team Foundation Server 2018 Update 1.2",
      "Microsoft Team Foundation Server 2017 Update 3.1",
      "Microsoft Team Foundation Server 2015 Update 4.2"
    ]
  },
  "referenceLink": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0866",
  "serverity": "\u4e2d",
  "submitTime": "2019-04-10",
  "title": "Azure DevOps Server\u548cTeam Foundation Server\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e"
}

CVE-2019-0866 (GCVE-0-2019-0866)

Vulnerability from cvelistv5

Published

2019-04-09 20:19

Modified

2024-08-04 17:58

Severity ?

CWE

Spoofing

Summary

A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0867, CVE-2019-0868, CVE-2019-0870, CVE-2019-0871.

References

▼	URL	Tags
	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0866	x_refsource_MISC
	http://www.securityfocus.com/bid/107749	vdb-entry, x_refsource_BID

Impacted products

Vendor

Product

Version

▼

Microsoft

Team Foundation Server

Version: 2017 Update 3.1

Microsoft	Team Foundation Server 2018	Version: Update 1.2 Version: Update 3.2
Microsoft	Azure DevOps Server	Version: 2019
Microsoft	Team Foundation Server 2015	Version: Update 4.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T17:58:59.577Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0866"
          },
          {
            "name": "107749",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/107749"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Team Foundation Server",
          "vendor": "Microsoft",
          "versions": [
            {
              "status": "affected",
              "version": "2017 Update 3.1"
            }
          ]
        },
        {
          "product": "Team Foundation Server 2018",
          "vendor": "Microsoft",
          "versions": [
            {
              "status": "affected",
              "version": "Update 1.2"
            },
            {
              "status": "affected",
              "version": "Update 3.2"
            }
          ]
        },
        {
          "product": "Azure DevOps Server",
          "vendor": "Microsoft",
          "versions": [
            {
              "status": "affected",
              "version": "2019"
            }
          ]
        },
        {
          "product": "Team Foundation Server 2015",
          "vendor": "Microsoft",
          "versions": [
            {
              "status": "affected",
              "version": "Update 4.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka \u0027Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability\u0027. This CVE ID is unique from CVE-2019-0867, CVE-2019-0868, CVE-2019-0870, CVE-2019-0871."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Spoofing",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-04-09T22:06:03",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0866"
        },
        {
          "name": "107749",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/107749"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@microsoft.com",
          "ID": "CVE-2019-0866",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Team Foundation Server",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "2017 Update 3.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Team Foundation Server 2018",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Update 1.2"
                          },
                          {
                            "version_value": "Update 3.2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Azure DevOps Server",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "2019"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Team Foundation Server 2015",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Update 4.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Microsoft"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka \u0027Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability\u0027. This CVE ID is unique from CVE-2019-0867, CVE-2019-0868, CVE-2019-0870, CVE-2019-0871."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Spoofing"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0866",
              "refsource": "MISC",
              "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0866"
            },
            {
              "name": "107749",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/107749"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2019-0866",
    "datePublished": "2019-04-09T20:19:48",
    "dateReserved": "2018-11-26T00:00:00",
    "dateUpdated": "2024-08-04T17:58:59.577Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted