CVE-2023-38155

Azure DevOps Server Remote Code Execution Vulnerability

State: Published
Severity: 7.0 High
Published: Sep 12, 2023
Updated: Oct 30, 2025
Reserved: Jul 12, 2023

Description

Azure DevOps Server Remote Code Execution Vulnerability

Scores

CVSS	Score	Vector	Source
3.1	7.0 High	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	microsoft

Weaknesses

CWE-502 Deserialization of Untrusted Data

Affected Products

Product	Versions
Azure DevOps Server 2019.0.1Microsoft	2019.0.0 to before 20230601.3Affected
Azure DevOps Server 2022.0.1Microsoft	2022.0.0 to before 20230825.4Affected
Azure DevOps Server 2020.1.2Microsoft	2020.1.0 to before 20230823.1Affected
Azure DevOps ServerMicrosoft	1.0.0 to before 20230825.1Affected
Azure DevOps Server 2020.0.2Microsoft	2020.0.0 to before 20230820.2Affected

References

Azure DevOps Server Remote Code Execution Vulnerabilityvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.