CVE-2019-0996

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2019-0996
A spoofing vulnerability exists in Azure DevOps Server when it improperly handles requests to authorize applications, resulting in a cross-site request forgery. An attacker who successfully exploited this vulnerability could bypass OAuth protections and register an application on behalf of the targeted user. To exploit this vulnerability, an attacker would need to create a page specifically designed to cause a cross-site request. The attacker would then need to convince a targeted user to click a link to the malicious page. The update addresses the vulnerability by modifying how Azure DevOps Server protects application registration requests.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector : AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

4.3 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-0996
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0996 Patch Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:o:microsoft:azure_devops_server:2019:*:*:*:*:*:*:*
History

20 May 2025, 18:15

Type Values Removed Values Added
References
  • () https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-0996 -
Summary (en) A spoofing vulnerability exists in Azure DevOps Server when it improperly handles requests to authorize applications, resulting in a cross-site request forgery, aka 'Azure DevOps Server Spoofing Vulnerability'. (en) A spoofing vulnerability exists in Azure DevOps Server when it improperly handles requests to authorize applications, resulting in a cross-site request forgery. An attacker who successfully exploited this vulnerability could bypass OAuth protections and register an application on behalf of the targeted user. To exploit this vulnerability, an attacker would need to create a page specifically designed to cause a cross-site request. The attacker would then need to convince a targeted user to click a link to the malicious page. The update addresses the vulnerability by modifying how Azure DevOps Server protects application registration requests.

21 Nov 2024, 04:17

Type Values Removed Values Added
References () https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0996 - Patch, Vendor Advisory () https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0996 - Patch, Vendor Advisory
Information

Published : 2019-06-12 14:29

Updated : 2025-05-20 18:15

NVD link : CVE-2019-0996

Mitre link : CVE-2019-0996

CVE.ORG link : CVE-2019-0996

JSON object : View

Products Affected

microsoft

  • azure_devops_server
CWE
CWE-352

Cross-Site Request Forgery (CSRF)