CVE-2019-0866

MEDIUM

Azure DevOps Server and Team Foundation Server - Cross-Site Scripting

Title source: llm

Description

A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0867, CVE-2019-0868, CVE-2019-0870, CVE-2019-0871.

References (2)

Core 2

Core References

Patch, Vendor Advisory x_refsource_misc

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0866

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/107749

Scores

CVSS v3 6.1

EPSS 0.0263

EPSS Percentile 83.9%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (4)

microsoft/azure_devops_server 2019

microsoft/team_foundation_server 2015 4.2

microsoft/team_foundation_server 2017 3.1

microsoft/team_foundation_server 2018 1.2 (2 CPE variants)

Published Apr 09, 2019

Tracked Since Feb 18, 2026