CVE-2018-8529

published 2018-11-15

CVE-2018-8529: A remote code execution vulnerability exists when Team Foundation Server (TFS) does not enable basic authorization on the communication between the TFS and…

Priority P2 63 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

A remote code execution vulnerability exists when Team Foundation Server (TFS) does not enable basic authorization on the communication between the TFS and Search services, aka "Team Foundation Server Remote Code Execution Vulnerability." This affects Team.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
microsoft	team	—	—
microsoft	team	—	—
microsoft	team_foundation_server	—	—
microsoft	team_foundation_server	—	—
msrc	team_foundation_server_2018_update_1.1	—	—
msrc	team_foundation_server_2018_update_3	—	—

Detection & IOCs extracted from sources · hover to see the quote

• → The vulnerability arises from missing basic authorization on the communication channel between the TFS service and the Search service. Detection should focus on unauthenticated/unauthorized requests sent directly to the TFS Search service endpoint. ↗
• → Monitor for unexpected or unauthorized command execution originating from the TFS Search service process, which could indicate exploitation of the missing authorization control. ↗

• · The vulnerability is present in TFS 2018.1.1 and TFS 2018.3 patch levels; patched versions are referenced by Microsoft. Ensure basic authorization is enabled on the TFS-to-Search service communication channel after applying the relevant patch. ↗

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

vendor_msrc 9.8 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.