CVE-2023-36561

CWE-284 — Improper Access Control4 documents4 sources
Severity
7.3HIGH
EPSS
0.3%
top 49.17%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Microsoft Azure Devops Server 2020.0.2Microsoft Azure Devops Server 2020.1.2Microsoft Azure Devops Server 2022.0.1+1 more
Timeline
PublishedOct 10

Description

Azure DevOps Server Elevation of Privilege Vulnerability

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LExploitability: 3.9 | Impact: 3.4

Affected Packages4 packages

▶CVEListV5microsoft/azure_devops_server_2020.0.22020.0.0 — 20230927.1
▶CVEListV5microsoft/azure_devops_server_2020.1.22020.1.0 — 20230926.2
▶CVEListV5microsoft/azure_devops_server_2022.0.12022.0.0 — 20230926.1
▶NVDmicrosoft/azure_devops_server2020.0.2, 2020.1.2, 2022.0.1+2

Patches

Patch: msrc.microsoft.com ↗Patch: msrc.microsoft.com ↗

🔴Vulnerability Details

2
CVEList
Azure DevOps Server Elevation of Privilege Vulnerability↗2023-10-10
▶
GHSA
GHSA-6r24-858h-vm25: Azure DevOps Server Elevation of Privilege Vulnerability↗2023-10-10
▶

📋Vendor Advisories

1
Microsoft
Azure DevOps Server Elevation of Privilege Vulnerability↗2023-10-10
▶
CVE-2023-36561 (HIGH CVSS 7.3) | Azure DevOps Server Elevation of Pr | cvebase.io