CVE-2019-0742

CWE-79 — Cross-site Scripting (XSS)4 documents4 sources

Severity

5.4MEDIUM

EPSS

0.8%

top 25.38%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Microsoft Team Foundation Server 2018 Microsoft Team Foundation Server

Timeline

PublishedMar 5

Latest updateMay 14

Description

A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0743.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages2 packages

▶NVDmicrosoft/team_foundation_server2018

▶CVEListV5microsoft/team_foundation_server_2018Update 3.2

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

GHSA

GHSA-wvmp-h3p2-gj8q: A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foundation Ser↗2022-05-14

▶

CVEList

CVE-2019-0742: A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foundation Ser↗2019-03-06

▶

📋Vendor Advisories

Microsoft

Team Foundation Server Cross-site Scripting Vulnerability↗2019-02-12

▶