CVE-2023-33136

Azure DevOps Server Remote Code Execution Vulnerability

State: Published
Severity: 8.8 High
Published: Sep 12, 2023
Updated: Oct 30, 2025
Reserved: May 17, 2023

Description

Azure DevOps Server Remote Code Execution Vulnerability

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:T/RC:C	microsoft

Weaknesses

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

Affected Products

Product	Versions
Azure DevOps Server 2020.0.2Microsoft	2020.0.0 to before 20230820.2Affected
Azure DevOps ServerMicrosoft	1.0.0 to before 20230825.1Affected
Azure DevOps Server 2020.1.2Microsoft	2020.1.0 to before 20230823.1Affected
Azure DevOps Server 2022.0.1Microsoft	2022.0.0 to before 20230825.4Affected
Azure DevOps Server 2019.0.1Microsoft	2019.0.0 to before 20230601.3Affected

References

Azure DevOps Server Remote Code Execution Vulnerabilityvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.