Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner

Sources

Sort by

Order

Apply ordering (override relevance)

CVE-2024-20667 (GCVE-0-2024-20667)

Vulnerability from nvd – Published: 2024-02-13 18:02 – Updated: 2025-05-09 18:18

Title

Azure DevOps Server Remote Code Execution Vulnerability

Summary

Azure DevOps Server Remote Code Execution Vulnerability

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Assigner

microsoft

References

1 reference

URL	Tags
https://msrc.microsoft.com/update-guide/vulnerabi…	vendor-advisory

Impacted products

3 products

Vendor	Product	Version
Microsoft	Azure DevOps Server 2022	Affected: 20231128.1 , < 20240126.4 (custom)
Microsoft	Azure DevOps Server	Affected: 1.0.0 , < 20240126.6 (custom)
Microsoft	Azure DevOps Server 2020.1.2	Affected: 2020.1.0 , < 20240126.2 (custom)

Date Public

2024-02-13 08:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T21:59:42.231Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Azure DevOps Server Remote Code Execution Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20667"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-20667",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-08T18:44:48.382661Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-09T18:18:56.932Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2022",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20240126.4",
              "status": "affected",
              "version": "20231128.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20240126.6",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2020.1.2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20240126.2",
              "status": "affected",
              "version": "2020.1.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20240126.4",
                  "versionStartIncluding": "20231128.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20240126.6",
                  "versionStartIncluding": "1.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20240126.2",
                  "versionStartIncluding": "2020.1.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2024-02-13T08:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Azure DevOps Server Remote Code Execution Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "CWE-77: Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-03T01:37:24.014Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Azure DevOps Server Remote Code Execution Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20667"
        }
      ],
      "title": "Azure DevOps Server Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2024-20667",
    "datePublished": "2024-02-13T18:02:07.424Z",
    "dateReserved": "2023-11-28T22:58:12.115Z",
    "dateUpdated": "2025-05-09T18:18:56.932Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-21751 (GCVE-0-2023-21751)

Vulnerability from nvd – Published: 2023-12-13 23:14 – Updated: 2025-01-01 02:18

Title

Azure DevOps Server Spoofing Vulnerability

Summary

Azure DevOps Server Spoofing Vulnerability

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C

CWE

CWE-284 - Improper Access Control

Assigner

microsoft

References

1 reference

URL	Tags
https://msrc.microsoft.com/update-guide/vulnerabi…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
Microsoft	Azure DevOps Server 2022	Affected: 20231128.1 , < 20231128.1 (custom)
Microsoft	Azure DevOps Server 2020.1.2	Affected: 2020.1.0 , < 20231127.4 (custom)

Date Public

2023-12-13 08:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T09:51:49.806Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Azure DevOps Server Spoofing Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21751"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2022",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20231128.1",
              "status": "affected",
              "version": "20231128.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2020.1.2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20231127.4",
              "status": "affected",
              "version": "2020.1.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20231128.1",
                  "versionStartIncluding": "20231128.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20231127.4",
                  "versionStartIncluding": "2020.1.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2023-12-13T08:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Azure DevOps Server Spoofing Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-01T02:18:47.376Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Azure DevOps Server Spoofing Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21751"
        }
      ],
      "title": "Azure DevOps Server Spoofing Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2023-21751",
    "datePublished": "2023-12-13T23:14:37.461Z",
    "dateReserved": "2022-12-13T20:22:00.846Z",
    "dateUpdated": "2025-01-01T02:18:47.376Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-36561 (GCVE-0-2023-36561)

Vulnerability from nvd – Published: 2023-10-10 17:08 – Updated: 2025-04-14 22:46

Title

Azure DevOps Server Elevation of Privilege Vulnerability

Summary

Azure DevOps Server Elevation of Privilege Vulnerability

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C

CWE

CWE-284 - Improper Access Control

Assigner

microsoft

References

1 reference

URL	Tags
https://msrc.microsoft.com/update-guide/vulnerabi…	vendor-advisory

Impacted products

3 products

Vendor	Product	Version
Microsoft	Azure DevOps Server 2022.0.1	Affected: 2022.0.0 , < 20230926.1 (custom)
Microsoft	Azure DevOps Server 2020.0.2	Affected: 2020.0.0 , < 20230927.1 (custom)
Microsoft	Azure DevOps Server 2020.1.2	Affected: 2020.1.0 , < 20230926.2 (custom)

Date Public

2023-10-10 07:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T16:52:53.451Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Azure DevOps Server Elevation of Privilege Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36561"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2022.0.1",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230926.1",
              "status": "affected",
              "version": "2022.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2020.0.2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230927.1",
              "status": "affected",
              "version": "2020.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2020.1.2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230926.2",
              "status": "affected",
              "version": "2020.1.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20230926.1",
                  "versionStartIncluding": "2022.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20230927.1",
                  "versionStartIncluding": "2020.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20230926.2",
                  "versionStartIncluding": "2020.1.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2023-10-10T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Azure DevOps Server Elevation of Privilege Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-14T22:46:33.530Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Azure DevOps Server Elevation of Privilege Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36561"
        }
      ],
      "title": "Azure DevOps Server Elevation of Privilege Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2023-36561",
    "datePublished": "2023-10-10T17:08:01.950Z",
    "dateReserved": "2023-06-23T20:11:38.789Z",
    "dateUpdated": "2025-04-14T22:46:33.530Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-38155 (GCVE-0-2023-38155)

Vulnerability from nvd – Published: 2023-09-12 16:58 – Updated: 2025-10-30 18:18

Title

Azure DevOps Server Remote Code Execution Vulnerability

Summary

Azure DevOps Server Remote Code Execution Vulnerability

Severity

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

CWE

CWE-502 - Deserialization of Untrusted Data

Assigner

microsoft

References

1 reference

URL	Tags
https://msrc.microsoft.com/update-guide/vulnerabi…	vendor-advisory

Impacted products

5 products

Vendor	Product	Version
Microsoft	Azure DevOps Server 2019.0.1	Affected: 2019.0.0 , < 20230601.3 (custom)
Microsoft	Azure DevOps Server 2022.0.1	Affected: 2022.0.0 , < 20230825.4 (custom)
Microsoft	Azure DevOps Server 2020.1.2	Affected: 2020.1.0 , < 20230823.1 (custom)
Microsoft	Azure DevOps Server	Affected: 1.0.0 , < 20230825.1 (custom)
Microsoft	Azure DevOps Server 2020.0.2	Affected: 2020.0.0 , < 20230820.2 (custom)

Date Public

2023-09-12 07:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T17:30:14.065Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Azure DevOps Server and Team Foundation Server Elevation of Privilege Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38155"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2019.0.1",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230601.3",
              "status": "affected",
              "version": "2019.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2022.0.1",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230825.4",
              "status": "affected",
              "version": "2022.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2020.1.2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230823.1",
              "status": "affected",
              "version": "2020.1.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230825.1",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2020.0.2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230820.2",
              "status": "affected",
              "version": "2020.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "20230601.3",
                  "versionStartIncluding": "2019.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20230825.4",
                  "versionStartIncluding": "2022.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20230823.1",
                  "versionStartIncluding": "2020.1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20230825.1",
                  "versionStartIncluding": "1.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20230820.2",
                  "versionStartIncluding": "2020.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2023-09-12T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Azure DevOps Server Remote Code Execution Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502: Deserialization of Untrusted Data",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-30T18:18:06.568Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Azure DevOps Server Remote Code Execution Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38155"
        }
      ],
      "title": "Azure DevOps Server Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2023-38155",
    "datePublished": "2023-09-12T16:58:37.646Z",
    "dateReserved": "2023-07-12T23:41:45.861Z",
    "dateUpdated": "2025-10-30T18:18:06.568Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-33136 (GCVE-0-2023-33136)

Vulnerability from nvd – Published: 2023-09-12 16:58 – Updated: 2025-10-30 18:17

Title

Azure DevOps Server Remote Code Execution Vulnerability

Summary

Azure DevOps Server Remote Code Execution Vulnerability

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:T/RC:C

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Assigner

microsoft

References

1 reference

URL	Tags
https://msrc.microsoft.com/update-guide/vulnerabi…	vendor-advisory

Impacted products

5 products

Vendor	Product	Version
Microsoft	Azure DevOps Server 2020.0.2	Affected: 2020.0.0 , < 20230820.2 (custom)
Microsoft	Azure DevOps Server	Affected: 1.0.0 , < 20230825.1 (custom)
Microsoft	Azure DevOps Server 2020.1.2	Affected: 2020.1.0 , < 20230823.1 (custom)
Microsoft	Azure DevOps Server 2022.0.1	Affected: 2022.0.0 , < 20230825.4 (custom)
Microsoft	Azure DevOps Server 2019.0.1	Affected: 2019.0.0 , < 20230601.3 (custom)

Date Public

2023-09-12 07:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-33136",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-22T20:13:06.923996Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-22T20:13:09.656Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T15:39:35.005Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Azure DevOps Server Remote Code Execution Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33136"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2020.0.2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230820.2",
              "status": "affected",
              "version": "2020.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230825.1",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2020.1.2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230823.1",
              "status": "affected",
              "version": "2020.1.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2022.0.1",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230825.4",
              "status": "affected",
              "version": "2022.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2019.0.1",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230601.3",
              "status": "affected",
              "version": "2019.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20230820.2",
                  "versionStartIncluding": "2020.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20230825.1",
                  "versionStartIncluding": "1.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20230823.1",
                  "versionStartIncluding": "2020.1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20230825.4",
                  "versionStartIncluding": "2022.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "20230601.3",
                  "versionStartIncluding": "2019.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2023-09-12T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Azure DevOps Server Remote Code Execution Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:T/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "CWE-77: Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-30T18:17:40.891Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Azure DevOps Server Remote Code Execution Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33136"
        }
      ],
      "title": "Azure DevOps Server Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2023-33136",
    "datePublished": "2023-09-12T16:58:34.967Z",
    "dateReserved": "2023-05-17T21:16:44.896Z",
    "dateUpdated": "2025-10-30T18:17:40.891Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-36869 (GCVE-0-2023-36869)

Vulnerability from nvd – Published: 2023-08-08 17:08 – Updated: 2025-01-01 01:59

Title

Azure DevOps Server Spoofing Vulnerability

Summary

Azure DevOps Server Spoofing Vulnerability

Severity

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/RL:O/RC:C

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

microsoft

References

1 reference

URL	Tags
https://msrc.microsoft.com/update-guide/vulnerabi…	vendor-advisory

Impacted products

4 products

Vendor	Product	Version
Microsoft	Azure DevOps Server	Affected: 1.0.0 , < 20230601.1 (custom)
Microsoft	Azure DevOps Server 2020.1.2	Affected: 2020.1.0 , < 20230601.3 (custom)
Microsoft	Azure DevOps Server 2022.0.1	Affected: 2022.0.0 , < 20230602.5 (custom)
Microsoft	Azure DevOps Server 2019.0.1	Affected: 2019.0.0 , < 20230721.6 (custom)

Date Public

2023-08-08 07:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-36869",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-08T17:06:43.487941Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-08T17:07:00.868Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T17:01:09.841Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Azure DevOps Server Spoofing Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36869"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230601.1",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2020.1.2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230601.3",
              "status": "affected",
              "version": "2020.1.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2022.0.1",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230602.5",
              "status": "affected",
              "version": "2022.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2019.0.1",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230721.6",
              "status": "affected",
              "version": "2019.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20230601.1",
                  "versionStartIncluding": "1.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20230601.3",
                  "versionStartIncluding": "2020.1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20230602.5",
                  "versionStartIncluding": "2022.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "20230721.6",
                  "versionStartIncluding": "2019.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2023-08-08T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Azure DevOps Server Spoofing Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-01T01:59:07.427Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Azure DevOps Server Spoofing Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36869"
        }
      ],
      "title": "Azure DevOps Server Spoofing Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2023-36869",
    "datePublished": "2023-08-08T17:08:19.962Z",
    "dateReserved": "2023-06-27T20:26:38.144Z",
    "dateUpdated": "2025-01-01T01:59:07.427Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-21569 (GCVE-0-2023-21569)

Vulnerability from nvd – Published: 2023-06-13 23:25 – Updated: 2025-01-01 01:43

Title

Azure DevOps Server Spoofing Vulnerability

Summary

Azure DevOps Server Spoofing Vulnerability

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

microsoft

References

1 reference

URL	Tags
https://msrc.microsoft.com/update-guide/vulnerabi…	vendor-advisory

Impacted products

3 products

Vendor	Product	Version
Microsoft	Azure DevOps Server 2020.1.2	Affected: 2020.1.0 , < 20230601.3 (custom)
Microsoft	Azure DevOps Server 2022	Affected: 20230131.0 , < 20230602.4 (custom)
Microsoft	Azure DevOps Server 2022.0.1	Affected: 2022.0.0 , < 20230602.5 (custom)

Date Public

2023-06-13 07:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-21569",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-19T14:04:10.459586Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-23T17:50:05.698Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T09:44:01.189Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Azure DevOps Server Spoofing Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21569"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2020.1.2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230601.3",
              "status": "affected",
              "version": "2020.1.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2022",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230602.4",
              "status": "affected",
              "version": "20230131.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2022.0.1",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230602.5",
              "status": "affected",
              "version": "2022.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20230601.3",
                  "versionStartIncluding": "2020.1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20230602.4",
                  "versionStartIncluding": "20230131.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20230602.5",
                  "versionStartIncluding": "2022.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2023-06-13T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Azure DevOps Server Spoofing Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-01T01:43:35.391Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Azure DevOps Server Spoofing Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21569"
        }
      ],
      "title": "Azure DevOps Server Spoofing Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2023-21569",
    "datePublished": "2023-06-13T23:25:57.688Z",
    "dateReserved": "2022-12-01T14:00:11.204Z",
    "dateUpdated": "2025-01-01T01:43:35.391Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-21565 (GCVE-0-2023-21565)

Vulnerability from nvd – Published: 2023-06-13 23:25 – Updated: 2025-01-01 01:43

Title

Azure DevOps Server Spoofing Vulnerability

Summary

Azure DevOps Server Spoofing Vulnerability

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N/E:U/RL:O/RC:C

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

microsoft

References

1 reference

URL	Tags
https://msrc.microsoft.com/update-guide/vulnerabi…	vendor-advisory

Impacted products

3 products

Vendor	Product	Version
Microsoft	Azure DevOps Server 2022	Affected: 20230131.0 , < 20230602.4 (custom)
Microsoft	Azure DevOps Server 2020.1.2	Affected: 2020.1.0 , < 20230601.3 (custom)
Microsoft	Azure DevOps Server 2022.0.1	Affected: 2022.0.0 , < 20230602.5 (custom)

Date Public

2023-06-13 07:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-21565",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-19T18:38:46.631479Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-19T18:38:53.200Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T09:44:01.540Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Azure DevOps Server Spoofing Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21565"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2022",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230602.4",
              "status": "affected",
              "version": "20230131.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2020.1.2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230601.3",
              "status": "affected",
              "version": "2020.1.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2022.0.1",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230602.5",
              "status": "affected",
              "version": "2022.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20230602.4",
                  "versionStartIncluding": "20230131.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20230601.3",
                  "versionStartIncluding": "2020.1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20230602.5",
                  "versionStartIncluding": "2022.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2023-06-13T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Azure DevOps Server Spoofing Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-01T01:43:36.030Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Azure DevOps Server Spoofing Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21565"
        }
      ],
      "title": "Azure DevOps Server Spoofing Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2023-21565",
    "datePublished": "2023-06-13T23:25:57.118Z",
    "dateReserved": "2022-12-01T14:00:11.204Z",
    "dateUpdated": "2025-01-01T01:43:36.030Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-21553 (GCVE-0-2023-21553)

Vulnerability from nvd – Published: 2023-02-14 20:09 – Updated: 2025-01-01 00:40

Title

Azure DevOps Server Remote Code Execution Vulnerability

Summary

Azure DevOps Server Remote Code Execution Vulnerability

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

microsoft

References

1 reference

URL	Tags
https://msrc.microsoft.com/update-guide/vulnerabi…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Microsoft	Azure DevOps Server 2020.1.2	Affected: 2020.1.0 , < 20230131.3 (custom)

Date Public

2023-02-14 08:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-21553",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-29T15:36:19.441101Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:19:43.653Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T09:44:01.099Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Azure DevOps Server Remote Code Execution Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21553"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2020.1.2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230131.3",
              "status": "affected",
              "version": "2020.1.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20230131.3",
                  "versionStartIncluding": "2020.1.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2023-02-14T08:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Azure DevOps Server Remote Code Execution Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-01T00:40:40.275Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Azure DevOps Server Remote Code Execution Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21553"
        }
      ],
      "title": "Azure DevOps Server Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2023-21553",
    "datePublished": "2023-02-14T20:09:18.909Z",
    "dateReserved": "2022-12-01T14:00:11.201Z",
    "dateUpdated": "2025-01-01T00:40:40.275Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-20667 (GCVE-0-2024-20667)

Vulnerability from cvelistv5 – Published: 2024-02-13 18:02 – Updated: 2025-05-09 18:18

Title

Azure DevOps Server Remote Code Execution Vulnerability

Summary

Azure DevOps Server Remote Code Execution Vulnerability

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Assigner

microsoft

References

1 reference

URL	Tags
https://msrc.microsoft.com/update-guide/vulnerabi…	vendor-advisory

Impacted products

3 products

Vendor	Product	Version
Microsoft	Azure DevOps Server 2022	Affected: 20231128.1 , < 20240126.4 (custom)
Microsoft	Azure DevOps Server	Affected: 1.0.0 , < 20240126.6 (custom)
Microsoft	Azure DevOps Server 2020.1.2	Affected: 2020.1.0 , < 20240126.2 (custom)

Date Public

2024-02-13 08:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T21:59:42.231Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Azure DevOps Server Remote Code Execution Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20667"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-20667",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-08T18:44:48.382661Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-09T18:18:56.932Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2022",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20240126.4",
              "status": "affected",
              "version": "20231128.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20240126.6",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2020.1.2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20240126.2",
              "status": "affected",
              "version": "2020.1.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20240126.4",
                  "versionStartIncluding": "20231128.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20240126.6",
                  "versionStartIncluding": "1.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20240126.2",
                  "versionStartIncluding": "2020.1.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2024-02-13T08:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Azure DevOps Server Remote Code Execution Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "CWE-77: Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-03T01:37:24.014Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Azure DevOps Server Remote Code Execution Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20667"
        }
      ],
      "title": "Azure DevOps Server Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2024-20667",
    "datePublished": "2024-02-13T18:02:07.424Z",
    "dateReserved": "2023-11-28T22:58:12.115Z",
    "dateUpdated": "2025-05-09T18:18:56.932Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-21751 (GCVE-0-2023-21751)

Vulnerability from cvelistv5 – Published: 2023-12-13 23:14 – Updated: 2025-01-01 02:18

Title

Azure DevOps Server Spoofing Vulnerability

Summary

Azure DevOps Server Spoofing Vulnerability

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C

CWE

CWE-284 - Improper Access Control

Assigner

microsoft

References

1 reference

URL	Tags
https://msrc.microsoft.com/update-guide/vulnerabi…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
Microsoft	Azure DevOps Server 2022	Affected: 20231128.1 , < 20231128.1 (custom)
Microsoft	Azure DevOps Server 2020.1.2	Affected: 2020.1.0 , < 20231127.4 (custom)

Date Public

2023-12-13 08:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T09:51:49.806Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Azure DevOps Server Spoofing Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21751"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2022",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20231128.1",
              "status": "affected",
              "version": "20231128.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2020.1.2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20231127.4",
              "status": "affected",
              "version": "2020.1.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20231128.1",
                  "versionStartIncluding": "20231128.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20231127.4",
                  "versionStartIncluding": "2020.1.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2023-12-13T08:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Azure DevOps Server Spoofing Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-01T02:18:47.376Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Azure DevOps Server Spoofing Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21751"
        }
      ],
      "title": "Azure DevOps Server Spoofing Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2023-21751",
    "datePublished": "2023-12-13T23:14:37.461Z",
    "dateReserved": "2022-12-13T20:22:00.846Z",
    "dateUpdated": "2025-01-01T02:18:47.376Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-36561 (GCVE-0-2023-36561)

Vulnerability from cvelistv5 – Published: 2023-10-10 17:08 – Updated: 2025-04-14 22:46

Title

Azure DevOps Server Elevation of Privilege Vulnerability

Summary

Azure DevOps Server Elevation of Privilege Vulnerability

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C

CWE

CWE-284 - Improper Access Control

Assigner

microsoft

References

1 reference

URL	Tags
https://msrc.microsoft.com/update-guide/vulnerabi…	vendor-advisory

Impacted products

3 products

Vendor	Product	Version
Microsoft	Azure DevOps Server 2022.0.1	Affected: 2022.0.0 , < 20230926.1 (custom)
Microsoft	Azure DevOps Server 2020.0.2	Affected: 2020.0.0 , < 20230927.1 (custom)
Microsoft	Azure DevOps Server 2020.1.2	Affected: 2020.1.0 , < 20230926.2 (custom)

Date Public

2023-10-10 07:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T16:52:53.451Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Azure DevOps Server Elevation of Privilege Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36561"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2022.0.1",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230926.1",
              "status": "affected",
              "version": "2022.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2020.0.2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230927.1",
              "status": "affected",
              "version": "2020.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2020.1.2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230926.2",
              "status": "affected",
              "version": "2020.1.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20230926.1",
                  "versionStartIncluding": "2022.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20230927.1",
                  "versionStartIncluding": "2020.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20230926.2",
                  "versionStartIncluding": "2020.1.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2023-10-10T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Azure DevOps Server Elevation of Privilege Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-14T22:46:33.530Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Azure DevOps Server Elevation of Privilege Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36561"
        }
      ],
      "title": "Azure DevOps Server Elevation of Privilege Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2023-36561",
    "datePublished": "2023-10-10T17:08:01.950Z",
    "dateReserved": "2023-06-23T20:11:38.789Z",
    "dateUpdated": "2025-04-14T22:46:33.530Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-38155 (GCVE-0-2023-38155)

Vulnerability from cvelistv5 – Published: 2023-09-12 16:58 – Updated: 2025-10-30 18:18

Title

Azure DevOps Server Remote Code Execution Vulnerability

Summary

Azure DevOps Server Remote Code Execution Vulnerability

Severity

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

CWE

CWE-502 - Deserialization of Untrusted Data

Assigner

microsoft

References

1 reference

URL	Tags
https://msrc.microsoft.com/update-guide/vulnerabi…	vendor-advisory

Impacted products

5 products

Vendor	Product	Version
Microsoft	Azure DevOps Server 2019.0.1	Affected: 2019.0.0 , < 20230601.3 (custom)
Microsoft	Azure DevOps Server 2022.0.1	Affected: 2022.0.0 , < 20230825.4 (custom)
Microsoft	Azure DevOps Server 2020.1.2	Affected: 2020.1.0 , < 20230823.1 (custom)
Microsoft	Azure DevOps Server	Affected: 1.0.0 , < 20230825.1 (custom)
Microsoft	Azure DevOps Server 2020.0.2	Affected: 2020.0.0 , < 20230820.2 (custom)

Date Public

2023-09-12 07:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T17:30:14.065Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Azure DevOps Server and Team Foundation Server Elevation of Privilege Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38155"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2019.0.1",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230601.3",
              "status": "affected",
              "version": "2019.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2022.0.1",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230825.4",
              "status": "affected",
              "version": "2022.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2020.1.2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230823.1",
              "status": "affected",
              "version": "2020.1.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230825.1",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2020.0.2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230820.2",
              "status": "affected",
              "version": "2020.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "20230601.3",
                  "versionStartIncluding": "2019.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20230825.4",
                  "versionStartIncluding": "2022.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20230823.1",
                  "versionStartIncluding": "2020.1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20230825.1",
                  "versionStartIncluding": "1.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20230820.2",
                  "versionStartIncluding": "2020.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2023-09-12T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Azure DevOps Server Remote Code Execution Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502: Deserialization of Untrusted Data",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-30T18:18:06.568Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Azure DevOps Server Remote Code Execution Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38155"
        }
      ],
      "title": "Azure DevOps Server Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2023-38155",
    "datePublished": "2023-09-12T16:58:37.646Z",
    "dateReserved": "2023-07-12T23:41:45.861Z",
    "dateUpdated": "2025-10-30T18:18:06.568Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-33136 (GCVE-0-2023-33136)

Vulnerability from cvelistv5 – Published: 2023-09-12 16:58 – Updated: 2025-10-30 18:17

Title

Azure DevOps Server Remote Code Execution Vulnerability

Summary

Azure DevOps Server Remote Code Execution Vulnerability

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:T/RC:C

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Assigner

microsoft

References

1 reference

URL	Tags
https://msrc.microsoft.com/update-guide/vulnerabi…	vendor-advisory

Impacted products

5 products

Vendor	Product	Version
Microsoft	Azure DevOps Server 2020.0.2	Affected: 2020.0.0 , < 20230820.2 (custom)
Microsoft	Azure DevOps Server	Affected: 1.0.0 , < 20230825.1 (custom)
Microsoft	Azure DevOps Server 2020.1.2	Affected: 2020.1.0 , < 20230823.1 (custom)
Microsoft	Azure DevOps Server 2022.0.1	Affected: 2022.0.0 , < 20230825.4 (custom)
Microsoft	Azure DevOps Server 2019.0.1	Affected: 2019.0.0 , < 20230601.3 (custom)

Date Public

2023-09-12 07:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-33136",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-22T20:13:06.923996Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-22T20:13:09.656Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T15:39:35.005Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Azure DevOps Server Remote Code Execution Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33136"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2020.0.2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230820.2",
              "status": "affected",
              "version": "2020.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230825.1",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2020.1.2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230823.1",
              "status": "affected",
              "version": "2020.1.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2022.0.1",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230825.4",
              "status": "affected",
              "version": "2022.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2019.0.1",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230601.3",
              "status": "affected",
              "version": "2019.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20230820.2",
                  "versionStartIncluding": "2020.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20230825.1",
                  "versionStartIncluding": "1.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20230823.1",
                  "versionStartIncluding": "2020.1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20230825.4",
                  "versionStartIncluding": "2022.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "20230601.3",
                  "versionStartIncluding": "2019.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2023-09-12T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Azure DevOps Server Remote Code Execution Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:T/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "CWE-77: Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-30T18:17:40.891Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Azure DevOps Server Remote Code Execution Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-33136"
        }
      ],
      "title": "Azure DevOps Server Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2023-33136",
    "datePublished": "2023-09-12T16:58:34.967Z",
    "dateReserved": "2023-05-17T21:16:44.896Z",
    "dateUpdated": "2025-10-30T18:17:40.891Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-36869 (GCVE-0-2023-36869)

Vulnerability from cvelistv5 – Published: 2023-08-08 17:08 – Updated: 2025-01-01 01:59

Title

Azure DevOps Server Spoofing Vulnerability

Summary

Azure DevOps Server Spoofing Vulnerability

Severity

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/RL:O/RC:C

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

microsoft

References

1 reference

URL	Tags
https://msrc.microsoft.com/update-guide/vulnerabi…	vendor-advisory

Impacted products

4 products

Vendor	Product	Version
Microsoft	Azure DevOps Server	Affected: 1.0.0 , < 20230601.1 (custom)
Microsoft	Azure DevOps Server 2020.1.2	Affected: 2020.1.0 , < 20230601.3 (custom)
Microsoft	Azure DevOps Server 2022.0.1	Affected: 2022.0.0 , < 20230602.5 (custom)
Microsoft	Azure DevOps Server 2019.0.1	Affected: 2019.0.0 , < 20230721.6 (custom)

Date Public

2023-08-08 07:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-36869",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-08T17:06:43.487941Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-08T17:07:00.868Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T17:01:09.841Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Azure DevOps Server Spoofing Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36869"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230601.1",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2020.1.2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230601.3",
              "status": "affected",
              "version": "2020.1.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2022.0.1",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230602.5",
              "status": "affected",
              "version": "2022.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2019.0.1",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230721.6",
              "status": "affected",
              "version": "2019.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20230601.1",
                  "versionStartIncluding": "1.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20230601.3",
                  "versionStartIncluding": "2020.1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20230602.5",
                  "versionStartIncluding": "2022.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "20230721.6",
                  "versionStartIncluding": "2019.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2023-08-08T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Azure DevOps Server Spoofing Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-01T01:59:07.427Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Azure DevOps Server Spoofing Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36869"
        }
      ],
      "title": "Azure DevOps Server Spoofing Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2023-36869",
    "datePublished": "2023-08-08T17:08:19.962Z",
    "dateReserved": "2023-06-27T20:26:38.144Z",
    "dateUpdated": "2025-01-01T01:59:07.427Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-21569 (GCVE-0-2023-21569)

Vulnerability from cvelistv5 – Published: 2023-06-13 23:25 – Updated: 2025-01-01 01:43

Title

Azure DevOps Server Spoofing Vulnerability

Summary

Azure DevOps Server Spoofing Vulnerability

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

microsoft

References

1 reference

URL	Tags
https://msrc.microsoft.com/update-guide/vulnerabi…	vendor-advisory

Impacted products

3 products

Vendor	Product	Version
Microsoft	Azure DevOps Server 2020.1.2	Affected: 2020.1.0 , < 20230601.3 (custom)
Microsoft	Azure DevOps Server 2022	Affected: 20230131.0 , < 20230602.4 (custom)
Microsoft	Azure DevOps Server 2022.0.1	Affected: 2022.0.0 , < 20230602.5 (custom)

Date Public

2023-06-13 07:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-21569",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-19T14:04:10.459586Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-23T17:50:05.698Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T09:44:01.189Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Azure DevOps Server Spoofing Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21569"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2020.1.2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230601.3",
              "status": "affected",
              "version": "2020.1.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2022",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230602.4",
              "status": "affected",
              "version": "20230131.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2022.0.1",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230602.5",
              "status": "affected",
              "version": "2022.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20230601.3",
                  "versionStartIncluding": "2020.1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20230602.4",
                  "versionStartIncluding": "20230131.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20230602.5",
                  "versionStartIncluding": "2022.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2023-06-13T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Azure DevOps Server Spoofing Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-01T01:43:35.391Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Azure DevOps Server Spoofing Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21569"
        }
      ],
      "title": "Azure DevOps Server Spoofing Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2023-21569",
    "datePublished": "2023-06-13T23:25:57.688Z",
    "dateReserved": "2022-12-01T14:00:11.204Z",
    "dateUpdated": "2025-01-01T01:43:35.391Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-21565 (GCVE-0-2023-21565)

Vulnerability from cvelistv5 – Published: 2023-06-13 23:25 – Updated: 2025-01-01 01:43

Title

Azure DevOps Server Spoofing Vulnerability

Summary

Azure DevOps Server Spoofing Vulnerability

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N/E:U/RL:O/RC:C

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

microsoft

References

1 reference

URL	Tags
https://msrc.microsoft.com/update-guide/vulnerabi…	vendor-advisory

Impacted products

3 products

Vendor	Product	Version
Microsoft	Azure DevOps Server 2022	Affected: 20230131.0 , < 20230602.4 (custom)
Microsoft	Azure DevOps Server 2020.1.2	Affected: 2020.1.0 , < 20230601.3 (custom)
Microsoft	Azure DevOps Server 2022.0.1	Affected: 2022.0.0 , < 20230602.5 (custom)

Date Public

2023-06-13 07:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-21565",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-19T18:38:46.631479Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-19T18:38:53.200Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T09:44:01.540Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Azure DevOps Server Spoofing Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21565"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2022",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230602.4",
              "status": "affected",
              "version": "20230131.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2020.1.2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230601.3",
              "status": "affected",
              "version": "2020.1.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2022.0.1",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230602.5",
              "status": "affected",
              "version": "2022.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20230602.4",
                  "versionStartIncluding": "20230131.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20230601.3",
                  "versionStartIncluding": "2020.1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20230602.5",
                  "versionStartIncluding": "2022.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2023-06-13T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Azure DevOps Server Spoofing Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-01T01:43:36.030Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Azure DevOps Server Spoofing Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21565"
        }
      ],
      "title": "Azure DevOps Server Spoofing Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2023-21565",
    "datePublished": "2023-06-13T23:25:57.118Z",
    "dateReserved": "2022-12-01T14:00:11.204Z",
    "dateUpdated": "2025-01-01T01:43:36.030Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-21553 (GCVE-0-2023-21553)

Vulnerability from cvelistv5 – Published: 2023-02-14 20:09 – Updated: 2025-01-01 00:40

Title

Azure DevOps Server Remote Code Execution Vulnerability

Summary

Azure DevOps Server Remote Code Execution Vulnerability

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

microsoft

References

1 reference

URL	Tags
https://msrc.microsoft.com/update-guide/vulnerabi…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Microsoft	Azure DevOps Server 2020.1.2	Affected: 2020.1.0 , < 20230131.3 (custom)

Date Public

2023-02-14 08:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-21553",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-29T15:36:19.441101Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:19:43.653Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T09:44:01.099Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Azure DevOps Server Remote Code Execution Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21553"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Azure DevOps Server 2020.1.2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "20230131.3",
              "status": "affected",
              "version": "2020.1.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:microsoft:azure_devops_server:*:-:*:*:*:*:*:*",
                  "versionEndExcluding": "20230131.3",
                  "versionStartIncluding": "2020.1.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2023-02-14T08:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Azure DevOps Server Remote Code Execution Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-01T00:40:40.275Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Azure DevOps Server Remote Code Execution Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21553"
        }
      ],
      "title": "Azure DevOps Server Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2023-21553",
    "datePublished": "2023-02-14T20:09:18.909Z",
    "dateReserved": "2022-12-01T14:00:11.201Z",
    "dateUpdated": "2025-01-01T00:40:40.275Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

18 vulnerabilities found for Azure DevOps Server 2020.1.2 by Microsoft

CVE-2024-20667 (GCVE-0-2024-20667)

CVE-2023-21751 (GCVE-0-2023-21751)

CVE-2023-36561 (GCVE-0-2023-36561)

CVE-2023-38155 (GCVE-0-2023-38155)

CVE-2023-33136 (GCVE-0-2023-33136)

CVE-2023-36869 (GCVE-0-2023-36869)

CVE-2023-21569 (GCVE-0-2023-21569)

CVE-2023-21565 (GCVE-0-2023-21565)

CVE-2023-21553 (GCVE-0-2023-21553)

CVE-2024-20667 (GCVE-0-2024-20667)

CVE-2023-21751 (GCVE-0-2023-21751)

CVE-2023-36561 (GCVE-0-2023-36561)

CVE-2023-38155 (GCVE-0-2023-38155)

CVE-2023-33136 (GCVE-0-2023-33136)

CVE-2023-36869 (GCVE-0-2023-36869)

CVE-2023-21569 (GCVE-0-2023-21569)

CVE-2023-21565 (GCVE-0-2023-21565)

CVE-2023-21553 (GCVE-0-2023-21553)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

18 vulnerabilities found for Azure DevOps Server 2020.1.2 by Microsoft

CVE-2024-20667 (GCVE-0-2024-20667)

CVE-2023-21751 (GCVE-0-2023-21751)

CVE-2023-36561 (GCVE-0-2023-36561)

CVE-2023-38155 (GCVE-0-2023-38155)

CVE-2023-33136 (GCVE-0-2023-33136)

CVE-2023-36869 (GCVE-0-2023-36869)

CVE-2023-21569 (GCVE-0-2023-21569)

CVE-2023-21565 (GCVE-0-2023-21565)

CVE-2023-21553 (GCVE-0-2023-21553)

CVE-2024-20667 (GCVE-0-2024-20667)

CVE-2023-21751 (GCVE-0-2023-21751)

CVE-2023-36561 (GCVE-0-2023-36561)

CVE-2023-38155 (GCVE-0-2023-38155)

CVE-2023-33136 (GCVE-0-2023-33136)

CVE-2023-36869 (GCVE-0-2023-36869)

CVE-2023-21569 (GCVE-0-2023-21569)

CVE-2023-21565 (GCVE-0-2023-21565)

CVE-2023-21553 (GCVE-0-2023-21553)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.