CVE-2023-21553
published 2023-02-14CVE-2023-21553: Azure DevOps Server Remote Code Execution Vulnerability
PriorityP348high7.5CVSS 3.1
AVNACHPRLUINSUCHIHAH
EPSS
1.41%
69.5th percentile
Azure DevOps Server Remote Code Execution Vulnerability
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | azure_devops_server | — | — |
| microsoft | azure_devops_server_2020.1.2 | >= 2020.1.0 < 20230131.3 | 20230131.3 |
| msrc | azure_devops_server_2020.1.2 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_msrc7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-hwv6-qxxw-8ffm: Azure DevOps Server Remote Code Execution Vulnerability
ghsa_unreviewed·2023-02-14
CVE-2023-21553 [HIGH] GHSA-hwv6-qxxw-8ffm: Azure DevOps Server Remote Code Execution Vulnerability
Azure DevOps Server Remote Code Execution Vulnerability
Microsoft
Azure DevOps Server Remote Code Execution Vulnerability
vendor_msrc·2023-02-14·CVSS 7.5
CVE-2023-21553 [HIGH] CWE-94 Azure DevOps Server Remote Code Execution Vulnerability
Azure DevOps Server Remote Code Execution Vulnerability
FAQ: According to the CVSS metric, the attack complexity is high (AC:H). What does this mean for this vulnerability?
Owning an affected domain is not enough to run the attack. For a successful attacker the appropriate variable must be used in the pipeline, and not every pipeline is vulnerable.
FAQ: According to the CVSS metric, the attack vector is network (AV:N), user interaction is none (UI:N), and privilege required is low (PR:L). What is the target used in the context of the remote code execution?
The attacker for this vulnerability could target the server accounts in an arbitrary or remote code execution. As an authenticated user, the attacker could attempt to trigger malicious code in the context of the server's account throug
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-02-14
Published