Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2020-0700
CVE-2020-0700:
vulnerability analysis and mitigation
Overview
A Cross-site Scripting (XSS) vulnerability exists in Azure DevOps Server, identified as CVE-2020-0700, due to improper sanitization of user-provided input. The vulnerability affects multiple versions of Azure DevOps Server 2019 and Team Foundation Server (MITRE CVE).
Technical details
The vulnerability occurs when Azure DevOps Server fails to properly sanitize user-provided input. An authenticated attacker could exploit this vulnerability by sending a specially crafted payload to the Team Foundation Server, which would then execute in the security context of the user whenever they visit the compromised page (BLEEPING COMPUTER).
Impact
The successful exploitation of this vulnerability could allow an attacker to perform cross-site scripting attacks on affected systems and execute scripts in the security context of the current user. This could enable the attacker to read unauthorized content, execute malicious code, and perform actions on behalf of the victim user, including changing permissions and deleting content (BLEEPING COMPUTER).
Mitigation and workarounds
Microsoft has addressed this vulnerability by ensuring that Azure DevOps Server properly sanitizes user inputs. The fix is available through security updates for affected versions of Azure DevOps Server 2019 and Team Foundation Server (BLEEPING COMPUTER).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management