CVE-2023-36869

Azure DevOps Server Spoofing Vulnerability

State: Published
Severity: 6.3 Medium
Published: Aug 8, 2023
Updated: Aug 10, 2026
Reserved: Jun 27, 2023

Description

Azure DevOps Server Spoofing Vulnerability

Scores

CVSS	Score	Vector	Source
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/RL:O/RC:C	microsoft

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
Azure DevOps ServerMicrosoft	1.0.0 to before 20230601.1Affected
Azure DevOps Server 2019.0.1Microsoft	2019.0.0 to before 20230721.6Affected
Azure DevOps Server 2020.1.2Microsoft	2020.1.0 to before 20230601.3Affected
Azure DevOps Server 2022.0.1Microsoft	2022.0.0 to before 20230602.5Affected

References

Azure DevOps Server Spoofing Vulnerabilityvendor-advisorypatch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.