Skip to content
OpenAdvisories
High MSRC-CVE-2023-21751 1 CVE

Azure DevOps Server Spoofing Vulnerability

Published Dec 12, 2023 · Updated Dec 13, 2023

Vendor: Microsoft

Summary

Impact: Spoofing. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

According to the CVSS metric,privileges required is low(PR:L). What does that mean for this vulnerability?
This means that an attacker needs to have a user account in the organization with the ability to run builds.

According to the CVSS metric, successful exploitation of this vulnerability could impact the integrity(I:H). What does that mean for this vulnerability?
Successful exploitation compromises the integrity of the build verification process, allowing an attacker to spoof and bypass verification.

Security updates
20231128.1 — https://learn.microsoft.com/en-us/azure/devops/server/release-notes/azuredevops2022u1?view=azure-devops&tabs=yaml
20231127.4 — https://learn.microsoft.com/en-us/azure/devops/server/release-notes/azuredevops2020u1?view=azure-devops

Vulnerabilities 1

Revision history

  1. #1

    Information published. This CVE was addressed by updates that were released in December 2023, but the CVE was inadvertently omitted from the December 2023 Security Updates. Microsoft strongly recommends that customers running affected versions of Azure DevOps Server install the December 2023 updates to be protected from this vulnerability.

References