CVE-2020-17135: 
vulnerability analysis and mitigation

Azure DevOps Server Spoofing Vulnerability (CVE-2020-17135) was disclosed in December 2020 as part of Microsoft's security updates. The vulnerability affects multiple versions of Azure DevOps Server and Team Foundation Services, including Azure DevOps Server 2019 Update 1.1, Azure DevOps Server 2019.0.1, and Team Foundation Server versions (Microsoft Security).

The vulnerability received a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N according to NVD's assessment. Microsoft's own assessment rated it slightly higher at 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N (NVD Database).

The successful exploitation of this vulnerability could allow an attacker to compromise the confidentiality and integrity of the affected system. The vulnerability specifically affects the spoofing protection mechanisms in Azure DevOps Server (Qualys Report).

The vulnerability requires low attack complexity and low privileges for exploitation. According to Microsoft's CVSS scoring, no user interaction is required for exploitation, though NVD's assessment suggests user interaction may be necessary (NVD Database).

Microsoft has released security updates to address this vulnerability. Affected users are advised to apply the appropriate patches for their specific version of Azure DevOps Server or Team Foundation Services (Microsoft Security).