CVE-2023-38155: Azure DevOps Server Remote Code Execution Vulnerability

Overview

Severity
High (CVSS 7)
CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
Category
Elevation of Privilege
Exploit Status
Not Exploited
Exploitation Likelihood
Less Likely
Patch Tuesday
2023-Sep
Released
2023-09-12
EPSS Score
0.34% (percentile: 56.8%)

FAQ

What privileges could be gained by an attacker who successfully exploited the vulnerability? An attacker who successfully exploited this vulnerability could gain administrator privileges. According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires an attacker to gather information specific to the environment and take additional actions prior to exploitation to prepare the target environment.

Affected Products (5)

Developer Tools

  • Azure DevOps Server 2019.0.1
  • Azure DevOps Server 2020.1.2
  • Azure DevOps Server 2019.1.2
  • Azure DevOps Server 2020.0.2

Azure

  • Azure DevOps Server 2022.0.1

Acknowledgments

Mikhail Shcherbakov (@yu5k3) working with <a href="https://www.zerodayinitiative.com/">Trend Micro Zero Day Initiative</a>

Revision History

  • 2023-09-12: Information published.