cnvd - cnvd-2019-24389

cnvd-2019-24389

Vulnerability from cnvd

Title: Microsoft Azure DevOps Server和Team Foundation Server远程代码执行漏洞

Description:

Team Foundation Server是Microsoft产品，提供源代码管理、报告、需求管理、项目管理、自动构建、实验室管理、测试及发布管理功能。 Azure DevOps Server原名Team Foundation Server (TFS)，是本地托管的一组协作式软件开发工具。Azure DevOps Server与现有IDE或编辑器集成，可使跨职能团队有效处理各种规模的项目。

Microsoft Azure DevOps Server和Team Foundation Server (TFS)存在远程代码执行漏洞，该漏洞源于相关产品未能正确处理用户输入，攻击者可通过提交特制的文件利用该漏洞在目标服务器上执行代码。

Severity: 高

Patch Name: Microsoft Azure DevOps Server和Team Foundation Server远程代码执行漏洞的补丁

Patch Description:

Microsoft Azure DevOps Server和Team Foundation Server (TFS)存在远程代码执行漏洞，该漏洞源于相关产品未能正确处理用户输入，攻击者可通过提交特制的文件利用该漏洞在目标服务器上执行代码。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1072

Reference: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1072

Impacted products

Name
['Microsoft Team Foundation Server 2018 Update 3.2', 'Microsoft Team Foundation Server 2018 Update 1.2', 'Microsoft Team Foundation Server 2017 Update 3.1', 'Microsoft Team Foundation Server 2015 Update 4.2', 'Microsoft Azure DevOps Server 2019.0.1', 'Microsoft Team Foundation Server 2012 Update 4', 'Microsoft Team Foundation Server 2010 SP1', 'Microsoft Team Foundation Server 2013 Update 5']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-1072",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2019-1072"
    }
  },
  "description": "Team Foundation Server\u662fMicrosoft\u4ea7\u54c1\uff0c\u63d0\u4f9b\u6e90\u4ee3\u7801\u7ba1\u7406\u3001\u62a5\u544a\u3001\u9700\u6c42\u7ba1\u7406\u3001\u9879\u76ee\u7ba1\u7406\u3001\u81ea\u52a8\u6784\u5efa\u3001\u5b9e\u9a8c\u5ba4\u7ba1\u7406\u3001\u6d4b\u8bd5\u53ca\u53d1\u5e03\u7ba1\u7406\u529f\u80fd\u3002\nAzure DevOps Server\u539f\u540dTeam Foundation Server (TFS)\uff0c\u662f\u672c\u5730\u6258\u7ba1\u7684\u4e00\u7ec4\u534f\u4f5c\u5f0f\u8f6f\u4ef6\u5f00\u53d1\u5de5\u5177\u3002Azure DevOps Server\u4e0e\u73b0\u6709IDE\u6216\u7f16\u8f91\u5668\u96c6\u6210\uff0c\u53ef\u4f7f\u8de8\u804c\u80fd\u56e2\u961f\u6709\u6548\u5904\u7406\u5404\u79cd\u89c4\u6a21\u7684\u9879\u76ee\u3002\n\nMicrosoft Azure DevOps Server\u548cTeam Foundation Server (TFS)\u5b58\u5728\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u76f8\u5173\u4ea7\u54c1\u672a\u80fd\u6b63\u786e\u5904\u7406\u7528\u6237\u8f93\u5165\uff0c\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u63d0\u4ea4\u7279\u5236\u7684\u6587\u4ef6\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u76ee\u6807\u670d\u52a1\u5668\u4e0a\u6267\u884c\u4ee3\u7801\u3002",
  "discovererName": "unknown",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1072",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-24389",
  "openTime": "2019-07-25",
  "patchDescription": "Team Foundation Server\u662fMicrosoft\u4ea7\u54c1\uff0c\u63d0\u4f9b\u6e90\u4ee3\u7801\u7ba1\u7406\u3001\u62a5\u544a\u3001\u9700\u6c42\u7ba1\u7406\u3001\u9879\u76ee\u7ba1\u7406\u3001\u81ea\u52a8\u6784\u5efa\u3001\u5b9e\u9a8c\u5ba4\u7ba1\u7406\u3001\u6d4b\u8bd5\u53ca\u53d1\u5e03\u7ba1\u7406\u529f\u80fd\u3002\r\nAzure DevOps Server\u539f\u540dTeam Foundation Server (TFS)\uff0c\u662f\u672c\u5730\u6258\u7ba1\u7684\u4e00\u7ec4\u534f\u4f5c\u5f0f\u8f6f\u4ef6\u5f00\u53d1\u5de5\u5177\u3002Azure DevOps Server\u4e0e\u73b0\u6709IDE\u6216\u7f16\u8f91\u5668\u96c6\u6210\uff0c\u53ef\u4f7f\u8de8\u804c\u80fd\u56e2\u961f\u6709\u6548\u5904\u7406\u5404\u79cd\u89c4\u6a21\u7684\u9879\u76ee\u3002\r\n\r\nMicrosoft Azure DevOps Server\u548cTeam Foundation Server (TFS)\u5b58\u5728\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u76f8\u5173\u4ea7\u54c1\u672a\u80fd\u6b63\u786e\u5904\u7406\u7528\u6237\u8f93\u5165\uff0c\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u63d0\u4ea4\u7279\u5236\u7684\u6587\u4ef6\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u76ee\u6807\u670d\u52a1\u5668\u4e0a\u6267\u884c\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Microsoft Azure DevOps Server\u548cTeam Foundation Server\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Microsoft Team Foundation Server 2018 Update 3.2",
      "Microsoft Team Foundation Server 2018 Update 1.2",
      "Microsoft Team Foundation Server 2017 Update 3.1",
      "Microsoft Team Foundation Server 2015 Update 4.2",
      "Microsoft Azure DevOps Server 2019.0.1",
      "Microsoft Team Foundation Server 2012 Update 4",
      "Microsoft Team Foundation Server 2010 SP1",
      "Microsoft Team Foundation Server 2013 Update 5"
    ]
  },
  "referenceLink": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1072",
  "serverity": "\u9ad8",
  "submitTime": "2019-07-10",
  "title": "Microsoft Azure DevOps Server\u548cTeam Foundation Server\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e"
}

CVE-2019-1072 (GCVE-0-2019-1072)

Vulnerability from cvelistv5

Published

2019-07-15 18:56

Modified

2024-08-04 18:06

Severity ?

CWE

Remote Code Execution

Summary

A remote code execution vulnerability exists when Azure DevOps Server and Team Foundation Server (TFS) improperly handle user input, aka 'Azure DevOps Server and Team Foundation Server Remote Code Execution Vulnerability'.

References

▼	URL	Tags
	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1072	x_refsource_MISC

Impacted products

Vendor

Product

Version

▼

Microsoft

Team Foundation Server 2012

Version: Update 4

Microsoft	Team Foundation Server 2013 Update 5	Version: unspecified
Microsoft	Team Foundation Server 2018	Version: Update 1.2 Version: Update 3.2
Microsoft	Team Foundation Server	Version: 2017 Update 3.1
Microsoft	Team Foundation Server 2015	Version: Update 4.2
Microsoft	Azure DevOps Server	Version: 2019.0.1
Microsoft	Team Foundation Server 2010	Version: SP1 (x86) Version: SP1 (x64)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T18:06:31.541Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1072"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Team Foundation Server 2012",
          "vendor": "Microsoft",
          "versions": [
            {
              "status": "affected",
              "version": "Update 4"
            }
          ]
        },
        {
          "product": "Team Foundation Server 2013 Update 5",
          "vendor": "Microsoft",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified"
            }
          ]
        },
        {
          "product": "Team Foundation Server 2018",
          "vendor": "Microsoft",
          "versions": [
            {
              "status": "affected",
              "version": "Update 1.2"
            },
            {
              "status": "affected",
              "version": "Update 3.2"
            }
          ]
        },
        {
          "product": "Team Foundation Server",
          "vendor": "Microsoft",
          "versions": [
            {
              "status": "affected",
              "version": "2017 Update 3.1"
            }
          ]
        },
        {
          "product": "Team Foundation Server 2015",
          "vendor": "Microsoft",
          "versions": [
            {
              "status": "affected",
              "version": "Update 4.2"
            }
          ]
        },
        {
          "product": "Azure DevOps Server",
          "vendor": "Microsoft",
          "versions": [
            {
              "status": "affected",
              "version": "2019.0.1"
            }
          ]
        },
        {
          "product": "Team Foundation Server 2010",
          "vendor": "Microsoft",
          "versions": [
            {
              "status": "affected",
              "version": "SP1 (x86)"
            },
            {
              "status": "affected",
              "version": "SP1 (x64)"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A remote code execution vulnerability exists when Azure DevOps Server and Team Foundation Server (TFS) improperly handle user input, aka \u0027Azure DevOps Server and Team Foundation Server Remote Code Execution Vulnerability\u0027."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Remote Code Execution",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-07-15T18:56:20",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1072"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@microsoft.com",
          "ID": "CVE-2019-1072",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Team Foundation Server 2012",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Update 4"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Team Foundation Server 2013 Update 5",
                      "version": {
                        "version_data": [
                          {
                            "version_value": ""
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Team Foundation Server 2018",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Update 1.2"
                          },
                          {
                            "version_value": "Update 3.2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Team Foundation Server",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "2017 Update 3.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Team Foundation Server 2015",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Update 4.2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Azure DevOps Server",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "2019.0.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Team Foundation Server 2010",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "SP1 (x86)"
                          },
                          {
                            "version_value": "SP1 (x64)"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Microsoft"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A remote code execution vulnerability exists when Azure DevOps Server and Team Foundation Server (TFS) improperly handle user input, aka \u0027Azure DevOps Server and Team Foundation Server Remote Code Execution Vulnerability\u0027."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Remote Code Execution"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1072",
              "refsource": "MISC",
              "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1072"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2019-1072",
    "datePublished": "2019-07-15T18:56:20",
    "dateReserved": "2018-11-26T00:00:00",
    "dateUpdated": "2024-08-04T18:06:31.541Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted