CVE-2019-1306: Input Validation
First published: Wed Sep 11 2019(Updated: )
A remote code execution vulnerability exists when Azure DevOps Server (ADO) and Team Foundation Server (TFS) fail to validate input properly, aka 'Azure DevOps and Team Foundation Server Remote Code Execution Vulnerability'.
Credit: secure@microsoft.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft Team Foundation Server | =2018-3.2 | |
| Microsoft Azure DevOps Server | =2019-update1 | |
| Microsoft Azure DevOps Server | =2019.0.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2019-1306?
CVE-2019-1306 refers to a remote code execution vulnerability that exists in Azure DevOps Server (ADO) and Team Foundation Server (TFS).
How does CVE-2019-1306 impact Azure DevOps Server and Team Foundation Server?
CVE-2019-1306 allows remote code execution when ADO and TFS fail to properly validate input.
What is the severity of CVE-2019-1306?
The severity of CVE-2019-1306 is critical with a CVSS score of 9.8.
What software versions are affected by CVE-2019-1306?
Microsoft Team Foundation Server 2018-3.2, Microsoft Azure DevOps Server 2019-update1, and Microsoft Azure DevOps Server 2019.0.1 are affected by CVE-2019-1306.
How can I fix CVE-2019-1306?
To fix CVE-2019-1306, update to the latest version of Microsoft Team Foundation Server or Microsoft Azure DevOps Server.
- collector/nvd-index
- vendor/microsoft
- canonical/microsoft team foundation server
- version/microsoft team foundation server/2018-3.2
- canonical/microsoft azure devops server
- version/microsoft azure devops server/2019-update1
- version/microsoft azure devops server/2019.0.1