Read the docs
TI-2019-00732 Aliases CVE-2019-0996GHSA-rm8m-fp2p-77cc

Azure DevOps Server Spoofing Vulnerability

Priority LOW 32CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-352.

Summary

A spoofing vulnerability exists in Azure DevOps Server when it improperly handles requests to authorize applications, resulting in a cross-site request forgery. An attacker who successfully exploited this vulnerability could bypass OAuth protections and register an application on behalf of the targeted user. To exploit this vulnerability, an attacker would need to create a page specifically designed to cause a cross-site request. The attacker would then need to convince a targeted user to click a link to the malicious page. The update addresses the vulnerability by modifying how Azure DevOps Server protects application registration requests.

Why it matters now

EPSS 0.0157 75th percentileScored 2026-11-07
Fix Fixed Azure DevOps Server 2019 (Microsoft): publication

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftAzure DevOps Server 2019before publicationpublicationPatch availableCNA
  • Azure DevOps Server 2019 VendorMicrosoft Affected before publication Fixed in publication Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:o:microsoft:azure_devops_server:2019:*:*:*:*:*:*:*2019VulnerableMicrosoft
  • cpe:2.3:o:microsoft:azure_devops_server:2019:*:*:*:*:*:*:* Versions 2019 Vulnerable ·Microsoft

Remediation

  • Fix · CNA Azure DevOps Server 2019 (Microsoft) Fixed in publication

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-0996
  2. 2026-10-03 Alias added: GHSA-rm8m-fp2p-77cc

References

Patch 1

Advisory 1

  • TI-2019-01021 Improper input validation in Microsoft Team Foundation Server 2018 CVSS 3.1CRITICAL 9.8
  • TI-2019-00802 Improper input validation in Microsoft Team Foundation Server 2012 CVSS 3.0CRITICAL 9.8
  • TI-2023-16315 Azure DevOps Server Remote Code Execution Vulnerability CVSS 3.1HIGH 8.8
  • TI-2019-00710 Improper output encoding in Microsoft Team Foundation Server 2018 CVSS 3.0MEDIUM 6.5
  • TI-2024-13479 Azure DevOps Server Remote Code Execution Vulnerability CVSS 3.1HIGH 7.5
  • TI-2023-19574 Azure DevOps Server Remote Code Execution Vulnerability CVSS 3.1HIGH 8.1
See all 39 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences