Summary
Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
How could an attacker exploit this vulnerability?
An attacker could exploit an integer overflow vulnerability that results in arbitrary heap writes, which could be used to perform arbitrary code execution.
According to the CVSS metric, privileges required is low (PR:L). Does the attacker need to be in an authenticated role on ADO?
Yes, the attacker needs to be authenticated to Azure DevOps server.
Security updates
2.39.1 — https://github.com/microsoft/azure-pipelines-agent/releases/tag/v2.217.2
Vulnerabilities 1
-
High 8.8
Azure DevOps Server Remote Code Execution Vulnerability
Azure DevOps Server Remote Code Execution Vulnerability
Revision history
-
#1
Information published.
References
-
CVE-2023-36437 Azure DevOps Server Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36437
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss