Azure DevOps Server HTML Injection Vulnerability - CVE-2020-1327ID: oval:org.secpod.oval:def:63798 | Date: (C)2020-06-11 (M)2022-10-10 |
Class: VULNERABILITY | Family: windows |
A spoofing vulnerability exists in Microsoft Azure DevOps Server when it fails to properly handle web requests. An attacker who successfully exploited the vulnerability could perform script or content injection attacks, and attempt to trick the user into disclosing sensitive information. An attacker could also redirect the user to a malicious website that could spoof content or the vulnerability could be used as a pivot to chain an attack with other vulnerabilities in web services. To exploit the vulnerability, an attacker could create a popup to harvest information or present a user with a malicious link.
Platform: |
Microsoft Windows 10 |
Microsoft Windows Server 2012 |
Microsoft Windows Server 2012 R2 |
Microsoft Windows Server 2016 |
Microsoft Windows Server 2019 |
Product: |
Azure DevOps Server 2019 |
Azure DevOps Server 2019 Update 1 |