Azure DevOps Server Spoofing Vulnerability

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
An attacker would have to send the victim a malicious link that the victim would have to click for a successful attack.

According to the CVSS metrics, successful exploitation of this vulnerability could lead to minor loss of confidentiality (C:L), integrity (I:L) and availability (A:L). What does that mean for this vulnerability?
While we cannot rule out the impact to Confidentiality, Integrity, and Availability, the ability to exploit this vulnerability by itself is limited. The impact to Confidentiality and Integrity is limited to a single Azure DevOps organization or project, depending on the victim's credentials. Impact to Availability is limited to the victim only.

Security updates
20230601.1 — https://learn.microsoft.com/en-us/azure/devops/server/release-notes/azuredevops2019u1?view=azure-devops
20230601.3 — https://learn.microsoft.com/en-us/azure/devops/server/release-notes/azuredevops2020u1?view=azure-devops
20230602.5 — https://learn.microsoft.com/en-us/azure/devops/server/release-notes/azuredevops2022?view=azure-devops