cnvd - cnvd-2019-09618

CNVD-2019-09618

Vulnerability from cnvd - Published: 2019-04-11

Title

Azure DevOps Server和Team Foundation Server跨站脚本漏洞

Description

Azure DevOps Server原名Team Foundation Server (TFS)，是本地托管的一组协作式软件开发工具。Azure DevOps Server与现有IDE或编辑器集成，可使跨职能团队有效处理各种规模的项目。Team Foundation Server是Microsoft产品，提供源代码管理、报告、需求管理、项目管理、自动构建、实验室管理、测试及发布管理功能。 Azure DevOps Server和Team Foundation Server存在跨站脚本漏洞。该漏洞源于这两款产品未能正确验证用户提供的输入。攻击者可利用该漏洞进行跨站脚本攻击，从而可在当前用户的安全上下文中运行脚本。

Severity

中

Patch Name

Azure DevOps Server和Team Foundation Server跨站脚本漏洞的补丁

Patch Description

Formal description

厂商已发布漏洞修复程序，请及时关注更新： https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0866

Reference

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0866

Impacted products

Name
['Microsoft Azure DevOps Server 2019', 'Microsoft Team Foundation Server 2018 Update 3.2', 'Microsoft Team Foundation Server 2018 Update 1.2', 'Microsoft Team Foundation Server 2017 Update 3.1', 'Microsoft Team Foundation Server 2015 Update 4.2']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-0866"
    }
  },
  "description": "Azure DevOps Server\u539f\u540dTeam Foundation Server (TFS)\uff0c\u662f\u672c\u5730\u6258\u7ba1\u7684\u4e00\u7ec4\u534f\u4f5c\u5f0f\u8f6f\u4ef6\u5f00\u53d1\u5de5\u5177\u3002Azure DevOps Server\u4e0e\u73b0\u6709IDE\u6216\u7f16\u8f91\u5668\u96c6\u6210\uff0c\u53ef\u4f7f\u8de8\u804c\u80fd\u56e2\u961f\u6709\u6548\u5904\u7406\u5404\u79cd\u89c4\u6a21\u7684\u9879\u76ee\u3002Team Foundation Server\u662fMicrosoft\u4ea7\u54c1\uff0c\u63d0\u4f9b\u6e90\u4ee3\u7801\u7ba1\u7406\u3001\u62a5\u544a\u3001\u9700\u6c42\u7ba1\u7406\u3001\u9879\u76ee\u7ba1\u7406\u3001\u81ea\u52a8\u6784\u5efa\u3001\u5b9e\u9a8c\u5ba4\u7ba1\u7406\u3001\u6d4b\u8bd5\u53ca\u53d1\u5e03\u7ba1\u7406\u529f\u80fd\u3002\n\nAzure DevOps Server\u548cTeam Foundation Server\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u8fd9\u4e24\u6b3e\u4ea7\u54c1\u672a\u80fd\u6b63\u786e\u9a8c\u8bc1\u7528\u6237\u63d0\u4f9b\u7684\u8f93\u5165\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u8fdb\u884c\u8de8\u7ad9\u811a\u672c\u653b\u51fb\uff0c\u4ece\u800c\u53ef\u5728\u5f53\u524d\u7528\u6237\u7684\u5b89\u5168\u4e0a\u4e0b\u6587\u4e2d\u8fd0\u884c\u811a\u672c\u3002",
  "discovererName": "Mikhail Shcherbakov of KTH Royal Institute of Technology",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0866",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-09618",
  "openTime": "2019-04-11",
  "patchDescription": "Azure DevOps Server\u539f\u540dTeam Foundation Server (TFS)\uff0c\u662f\u672c\u5730\u6258\u7ba1\u7684\u4e00\u7ec4\u534f\u4f5c\u5f0f\u8f6f\u4ef6\u5f00\u53d1\u5de5\u5177\u3002Azure DevOps Server\u4e0e\u73b0\u6709IDE\u6216\u7f16\u8f91\u5668\u96c6\u6210\uff0c\u53ef\u4f7f\u8de8\u804c\u80fd\u56e2\u961f\u6709\u6548\u5904\u7406\u5404\u79cd\u89c4\u6a21\u7684\u9879\u76ee\u3002Team Foundation Server\u662fMicrosoft\u4ea7\u54c1\uff0c\u63d0\u4f9b\u6e90\u4ee3\u7801\u7ba1\u7406\u3001\u62a5\u544a\u3001\u9700\u6c42\u7ba1\u7406\u3001\u9879\u76ee\u7ba1\u7406\u3001\u81ea\u52a8\u6784\u5efa\u3001\u5b9e\u9a8c\u5ba4\u7ba1\u7406\u3001\u6d4b\u8bd5\u53ca\u53d1\u5e03\u7ba1\u7406\u529f\u80fd\u3002\r\n\r\nAzure DevOps Server\u548cTeam Foundation Server\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u8fd9\u4e24\u6b3e\u4ea7\u54c1\u672a\u80fd\u6b63\u786e\u9a8c\u8bc1\u7528\u6237\u63d0\u4f9b\u7684\u8f93\u5165\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u8fdb\u884c\u8de8\u7ad9\u811a\u672c\u653b\u51fb\uff0c\u4ece\u800c\u53ef\u5728\u5f53\u524d\u7528\u6237\u7684\u5b89\u5168\u4e0a\u4e0b\u6587\u4e2d\u8fd0\u884c\u811a\u672c\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Azure DevOps Server\u548cTeam Foundation Server\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Microsoft Azure DevOps Server 2019",
      "Microsoft Team Foundation Server 2018 Update 3.2",
      "Microsoft Team Foundation Server 2018 Update 1.2",
      "Microsoft Team Foundation Server 2017 Update 3.1",
      "Microsoft Team Foundation Server 2015 Update 4.2"
    ]
  },
  "referenceLink": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0866",
  "serverity": "\u4e2d",
  "submitTime": "2019-04-10",
  "title": "Azure DevOps Server\u548cTeam Foundation Server\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e"
}

CVE-2019-0866 (GCVE-0-2019-0866)

Vulnerability from cvelistv5 – Published: 2019-04-09 20:19 – Updated: 2024-08-04 17:58

Summary

A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0867, CVE-2019-0868, CVE-2019-0870, CVE-2019-0871.

Severity ?

No CVSS data available.

CWE

Spoofing

Assigner

microsoft

References

URL

Tags

	https://portal.msrc.microsoft.com/en-US/security-…	x_refsource_MISC
	http://www.securityfocus.com/bid/107749	vdb-entryx_refsource_BID

Impacted products

Vendor

Product

Version

Microsoft

Team Foundation Server

Affected: 2017 Update 3.1

Microsoft	Team Foundation Server 2018	Affected: Update 1.2 Affected: Update 3.2
Microsoft	Azure DevOps Server	Affected: 2019
Microsoft	Team Foundation Server 2015	Affected: Update 4.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T17:58:59.577Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0866"
          },
          {
            "name": "107749",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/107749"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Team Foundation Server",
          "vendor": "Microsoft",
          "versions": [
            {
              "status": "affected",
              "version": "2017 Update 3.1"
            }
          ]
        },
        {
          "product": "Team Foundation Server 2018",
          "vendor": "Microsoft",
          "versions": [
            {
              "status": "affected",
              "version": "Update 1.2"
            },
            {
              "status": "affected",
              "version": "Update 3.2"
            }
          ]
        },
        {
          "product": "Azure DevOps Server",
          "vendor": "Microsoft",
          "versions": [
            {
              "status": "affected",
              "version": "2019"
            }
          ]
        },
        {
          "product": "Team Foundation Server 2015",
          "vendor": "Microsoft",
          "versions": [
            {
              "status": "affected",
              "version": "Update 4.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka \u0027Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability\u0027. This CVE ID is unique from CVE-2019-0867, CVE-2019-0868, CVE-2019-0870, CVE-2019-0871."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Spoofing",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-04-09T22:06:03",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0866"
        },
        {
          "name": "107749",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/107749"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@microsoft.com",
          "ID": "CVE-2019-0866",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Team Foundation Server",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "2017 Update 3.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Team Foundation Server 2018",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Update 1.2"
                          },
                          {
                            "version_value": "Update 3.2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Azure DevOps Server",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "2019"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Team Foundation Server 2015",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Update 4.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Microsoft"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka \u0027Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability\u0027. This CVE ID is unique from CVE-2019-0867, CVE-2019-0868, CVE-2019-0870, CVE-2019-0871."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Spoofing"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0866",
              "refsource": "MISC",
              "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0866"
            },
            {
              "name": "107749",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/107749"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2019-0866",
    "datePublished": "2019-04-09T20:19:48",
    "dateReserved": "2018-11-26T00:00:00",
    "dateUpdated": "2024-08-04T17:58:59.577Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2019-09618

CVE-2019-0866 (GCVE-0-2019-0866)

Tags

Sightings

Nomenclature