Vulnerability Description
A spoofing vulnerability exists in Azure DevOps Server when it improperly handles requests to authorize applications, resulting in a cross-site request forgery. An attacker who successfully exploited this vulnerability could bypass OAuth protections and register an application on behalf of the targeted user. To exploit this vulnerability, an attacker would need to create a page specifically designed to cause a cross-site request. The attacker would then need to convince a targeted user to click a link to the malicious page. The update addresses the vulnerability by modifying how Azure DevOps Server protects application registration requests.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Azure Devops Server | 2019 |
Related Weaknesses (CWE)
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-0996
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0996PatchVendor Advisory
FAQ
What is CVE-2019-0996?
CVE-2019-0996 is a vulnerability with a CVSS score of 6.5 (MEDIUM). A spoofing vulnerability exists in Azure DevOps Server when it improperly handles requests to authorize applications, resulting in a cross-site request forgery. An attacker who successfully exploited ...
How severe is CVE-2019-0996?
CVE-2019-0996 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-0996?
Check the references section above for vendor advisories and patch information. Affected products include: Microsoft Azure Devops Server.