All the vulnerabilites related to Microsoft - Azure DevOps Server 2022
cve-2023-21569
Vulnerability from cvelistv5
Published
2023-06-13 23:25
Modified
2024-08-02 09:44
Severity ?
EPSS score ?
Summary
Azure DevOps Server Spoofing Vulnerability
References
▼ | URL | Tags |
---|---|---|
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21569 | vendor-advisory |
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2023-21569", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-07-19T14:04:10.459586Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-07-23T17:50:05.698Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T09:44:01.189Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "Azure DevOps Server Spoofing Vulnerability", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21569" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "cpes": [ "cpe:2.3:o:microsoft:azure_devops_server:2020:-:*:*:*:*:*:*" ], "platforms": [ "Unknown" ], "product": "Azure DevOps Server 2020.1.2", "vendor": "Microsoft", "versions": [ { "lessThan": "20230601.3", "status": "affected", "version": "2020.1.0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:microsoft:azure_devops_server:2022:-:*:*:*:*:*:*" ], "platforms": [ "Unknown" ], "product": "Azure DevOps Server 2022", "vendor": "Microsoft", "versions": [ { "lessThan": "20230602.4", "status": "affected", "version": "20230131.0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:microsoft:azure_devops_server:2022.0.1:-:*:*:*:*:*:*" ], "platforms": [ "Unknown" ], "product": "Azure DevOps Server 2022.0.1", "vendor": "Microsoft", "versions": [ { "lessThan": "20230602.5", "status": "affected", "version": "2022.0.0", "versionType": "custom" } ] } ], "datePublic": "2023-06-13T07:00:00+00:00", "descriptions": [ { "lang": "en-US", "value": "Azure DevOps Server Spoofing Vulnerability" } ], "metrics": [ { "cvssV3_1": { "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en-US", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)", "lang": "en-US", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-07-19T20:21:48.125Z", "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft" }, "references": [ { "name": "Azure DevOps Server Spoofing Vulnerability", "tags": [ "vendor-advisory" ], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21569" } ], "title": "Azure DevOps Server Spoofing Vulnerability" } }, "cveMetadata": { "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "assignerShortName": "microsoft", "cveId": "CVE-2023-21569", "datePublished": "2023-06-13T23:25:57.688Z", "dateReserved": "2022-12-01T14:00:11.204Z", "dateUpdated": "2024-08-02T09:44:01.189Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-21564
Vulnerability from cvelistv5
Published
2023-02-14 19:33
Modified
2024-08-02 09:44
Severity ?
EPSS score ?
Summary
Azure DevOps Server Cross-Site Scripting Vulnerability
References
▼ | URL | Tags |
---|---|---|
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21564 | vendor-advisory |
Impacted products
▼ | Vendor | Product |
---|---|---|
Microsoft | Azure DevOps Server 2022 |
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2023-21564", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-05-29T15:39:37.560837Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-06-04T17:19:42.307Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T09:44:01.177Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "Azure DevOps Server Cross-Site Scripting Vulnerability", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21564" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "cpes": [ "cpe:2.3:o:microsoft:azure_devops_server:2022:-:*:*:*:*:*:*" ], "platforms": [ "Unknown" ], "product": "Azure DevOps Server 2022", "vendor": "Microsoft", "versions": [ { "lessThan": "20230131.1", "status": "affected", "version": "20230131.0", "versionType": "custom" } ] } ], "datePublic": "2023-02-14T08:00:00+00:00", "descriptions": [ { "lang": "en-US", "value": "Azure DevOps Server Cross-Site Scripting Vulnerability" } ], "metrics": [ { "cvssV3_1": { "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N/E:U/RL:O/RC:C", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en-US", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)", "lang": "en-US", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-05-29T02:05:36.594Z", "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft" }, "references": [ { "name": "Azure DevOps Server Cross-Site Scripting Vulnerability", "tags": [ "vendor-advisory" ], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21564" } ], "title": "Azure DevOps Server Cross-Site Scripting Vulnerability" } }, "cveMetadata": { "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "assignerShortName": "microsoft", "cveId": "CVE-2023-21564", "datePublished": "2023-02-14T19:33:48.526Z", "dateReserved": "2022-12-01T14:00:11.204Z", "dateUpdated": "2024-08-02T09:44:01.177Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-20667
Vulnerability from cvelistv5
Published
2024-02-13 18:02
Modified
2024-10-09 01:49
Severity ?
EPSS score ?
Summary
Azure DevOps Server Remote Code Execution Vulnerability
References
▼ | URL | Tags |
---|---|---|
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20667 | vendor-advisory |
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-01T21:59:42.231Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "Azure DevOps Server Remote Code Execution Vulnerability", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20667" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "cpes": [ "cpe:2.3:o:microsoft:azure_devops_server:2022.1:-:*:*:*:*:*:*" ], "platforms": [ "Unknown" ], "product": "Azure DevOps Server 2022", "vendor": "Microsoft", "versions": [ { "lessThan": "20240126.4", "status": "affected", "version": "20231128.1", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:microsoft:azure_devops_server:2019.1.2:-:*:*:*:*:*:*" ], "platforms": [ "Unknown" ], "product": "Azure DevOps Server", "vendor": "Microsoft", "versions": [ { "lessThan": "20240126.6", "status": "affected", "version": "1.0.0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:microsoft:azure_devops_server:2020:-:*:*:*:*:*:*" ], "platforms": [ "Unknown" ], "product": "Azure DevOps Server 2020.1.2", "vendor": "Microsoft", "versions": [ { "lessThan": "20240126.2", "status": "affected", "version": "2020.1.0", "versionType": "custom" } ] } ], "datePublic": "2024-02-13T08:00:00+00:00", "descriptions": [ { "lang": "en-US", "value": "Azure DevOps Server Remote Code Execution Vulnerability" } ], "metrics": [ { "cvssV3_1": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en-US", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-77", "description": "CWE-77: Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)", "lang": "en-US", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-09T01:49:53.220Z", "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft" }, "references": [ { "name": "Azure DevOps Server Remote Code Execution Vulnerability", "tags": [ "vendor-advisory" ], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20667" } ], "title": "Azure DevOps Server Remote Code Execution Vulnerability" } }, "cveMetadata": { "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "assignerShortName": "microsoft", "cveId": "CVE-2024-20667", "datePublished": "2024-02-13T18:02:07.424Z", "dateReserved": "2023-11-28T22:58:12.115Z", "dateUpdated": "2024-10-09T01:49:53.220Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-35267
Vulnerability from cvelistv5
Published
2024-07-09 17:02
Modified
2024-10-08 16:14
Severity ?
EPSS score ?
Summary
Azure DevOps Server Spoofing Vulnerability
References
▼ | URL | Tags |
---|---|---|
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35267 | vendor-advisory |
Impacted products
▼ | Vendor | Product |
---|---|---|
Microsoft | Azure DevOps Server 2022 |
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-35267", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-07-23T19:01:43.343006Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-07-23T19:01:55.482Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T03:07:46.862Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "Azure DevOps Server Spoofing Vulnerability", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35267" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "cpes": [ "cpe:2.3:o:microsoft:azure_devops_server:2022.1:-:*:*:*:*:*:*" ], "platforms": [ "Unknown" ], "product": "Azure DevOps Server 2022", "vendor": "Microsoft", "versions": [ { "lessThan": "20240702.1", "status": "affected", "version": "20231128.1", "versionType": "custom" } ] } ], "datePublic": "2024-07-09T07:00:00+00:00", "descriptions": [ { "lang": "en-US", "value": "Azure DevOps Server Spoofing Vulnerability" } ], "metrics": [ { "cvssV3_1": { "baseScore": 7.6, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en-US", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)", "lang": "en-US", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-08T16:14:23.123Z", "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft" }, "references": [ { "name": "Azure DevOps Server Spoofing Vulnerability", "tags": [ "vendor-advisory" ], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35267" } ], "title": "Azure DevOps Server Spoofing Vulnerability" } }, "cveMetadata": { "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "assignerShortName": "microsoft", "cveId": "CVE-2024-35267", "datePublished": "2024-07-09T17:02:43.425Z", "dateReserved": "2024-05-14T20:14:47.413Z", "dateUpdated": "2024-10-08T16:14:23.123Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-21565
Vulnerability from cvelistv5
Published
2023-06-13 23:25
Modified
2024-08-02 09:44
Severity ?
EPSS score ?
Summary
Azure DevOps Server Spoofing Vulnerability
References
▼ | URL | Tags |
---|---|---|
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21565 | vendor-advisory |
Impacted products
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2023-21565", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-07-19T18:38:46.631479Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-07-19T18:38:53.200Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-02T09:44:01.540Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "Azure DevOps Server Spoofing Vulnerability", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21565" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "cpes": [ "cpe:2.3:o:microsoft:azure_devops_server:2022:-:*:*:*:*:*:*" ], "platforms": [ "Unknown" ], "product": "Azure DevOps Server 2022", "vendor": "Microsoft", "versions": [ { "lessThan": "20230602.4", "status": "affected", "version": "20230131.0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:microsoft:azure_devops_server:2020:-:*:*:*:*:*:*" ], "platforms": [ "Unknown" ], "product": "Azure DevOps Server 2020.1.2", "vendor": "Microsoft", "versions": [ { "lessThan": "20230601.3", "status": "affected", "version": "2020.1.0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:microsoft:azure_devops_server:2022.0.1:-:*:*:*:*:*:*" ], "platforms": [ "Unknown" ], "product": "Azure DevOps Server 2022.0.1", "vendor": "Microsoft", "versions": [ { "lessThan": "20230602.5", "status": "affected", "version": "2022.0.0", "versionType": "custom" } ] } ], "datePublic": "2023-06-13T07:00:00+00:00", "descriptions": [ { "lang": "en-US", "value": "Azure DevOps Server Spoofing Vulnerability" } ], "metrics": [ { "cvssV3_1": { "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N/E:U/RL:O/RC:C", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en-US", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)", "lang": "en-US", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-07-19T20:21:48.670Z", "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft" }, "references": [ { "name": "Azure DevOps Server Spoofing Vulnerability", "tags": [ "vendor-advisory" ], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21565" } ], "title": "Azure DevOps Server Spoofing Vulnerability" } }, "cveMetadata": { "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "assignerShortName": "microsoft", "cveId": "CVE-2023-21565", "datePublished": "2023-06-13T23:25:57.118Z", "dateReserved": "2022-12-01T14:00:11.204Z", "dateUpdated": "2024-08-02T09:44:01.540Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2023-21751
Vulnerability from cvelistv5
Published
2023-12-13 23:14
Modified
2024-08-02 09:51
Severity ?
EPSS score ?
Summary
Azure DevOps Server Spoofing Vulnerability
References
▼ | URL | Tags |
---|---|---|
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21751 | vendor-advisory |
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T09:51:49.806Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "Azure DevOps Server Spoofing Vulnerability", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21751" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "cpes": [ "cpe:2.3:o:microsoft:azure_devops_server:2022.1:-:*:*:*:*:*:*" ], "platforms": [ "Unknown" ], "product": "Azure DevOps Server 2022", "vendor": "Microsoft", "versions": [ { "lessThan": "20231128.1", "status": "affected", "version": "20231128.1", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:microsoft:azure_devops_server:2020:-:*:*:*:*:*:*" ], "platforms": [ "Unknown" ], "product": "Azure DevOps Server 2020.1.2", "vendor": "Microsoft", "versions": [ { "lessThan": "20231127.4", "status": "affected", "version": "2020.1.0", "versionType": "custom" } ] } ], "datePublic": "2023-12-13T08:00:00+00:00", "descriptions": [ { "lang": "en-US", "value": "Azure DevOps Server Spoofing Vulnerability" } ], "metrics": [ { "cvssV3_1": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en-US", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-284", "description": "CWE-284: Improper Access Control", "lang": "en-US", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-05-29T01:15:43.082Z", "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft" }, "references": [ { "name": "Azure DevOps Server Spoofing Vulnerability", "tags": [ "vendor-advisory" ], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21751" } ], "title": "Azure DevOps Server Spoofing Vulnerability" } }, "cveMetadata": { "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "assignerShortName": "microsoft", "cveId": "CVE-2023-21751", "datePublished": "2023-12-13T23:14:37.461Z", "dateReserved": "2022-12-13T20:22:00.846Z", "dateUpdated": "2024-08-02T09:51:49.806Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-35266
Vulnerability from cvelistv5
Published
2024-07-09 17:02
Modified
2024-10-08 16:14
Severity ?
EPSS score ?
Summary
Azure DevOps Server Spoofing Vulnerability
References
▼ | URL | Tags |
---|---|---|
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35266 | vendor-advisory |
Impacted products
▼ | Vendor | Product |
---|---|---|
Microsoft | Azure DevOps Server 2022 |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T03:07:47.175Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "Azure DevOps Server Spoofing Vulnerability", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35266" } ], "title": "CVE Program Container" }, { "metrics": [ { "other": { "content": { "id": "CVE-2024-35266", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-07-26T13:02:17.828361Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-08-05T10:25:10.758Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "cpes": [ "cpe:2.3:o:microsoft:azure_devops_server:2022.1:-:*:*:*:*:*:*" ], "platforms": [ "Unknown" ], "product": "Azure DevOps Server 2022", "vendor": "Microsoft", "versions": [ { "lessThan": "20240702.1", "status": "affected", "version": "20231128.1", "versionType": "custom" } ] } ], "datePublic": "2024-07-09T07:00:00+00:00", "descriptions": [ { "lang": "en-US", "value": "Azure DevOps Server Spoofing Vulnerability" } ], "metrics": [ { "cvssV3_1": { "baseScore": 7.6, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en-US", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)", "lang": "en-US", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-08T16:14:22.590Z", "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft" }, "references": [ { "name": "Azure DevOps Server Spoofing Vulnerability", "tags": [ "vendor-advisory" ], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35266" } ], "title": "Azure DevOps Server Spoofing Vulnerability" } }, "cveMetadata": { "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "assignerShortName": "microsoft", "cveId": "CVE-2024-35266", "datePublished": "2024-07-09T17:02:42.873Z", "dateReserved": "2024-05-14T20:14:47.413Z", "dateUpdated": "2024-10-08T16:14:22.590Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }