CVE-2019-0872

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0979.

Metrics

CVSS 3.0 5.4/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
MicrosoftTeam Foundation Server2017 Update 3.1
MicrosoftTeam Foundation Server 2018Update 1.2; Update 3.2
MicrosoftAzure DevOps Server2019
MicrosoftTeam Foundation Server 2015Update 4.2

References

Timeline

Published
May 16, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-08746.1A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server does not properly sanitize user provided input, aka 'Azure DevOpsCVE-2019-08757.5An elevation of privilege vulnerability exists when Azure DevOps Server 2019 does not properly enforce project permissions, aka 'Azure DevOpCVE-2019-08765.5An information disclosure vulnerability exists when affected Open Enclave SDK versions improperly handle objects in memory, aka 'Open EnclavCVE-2019-08777.8A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database EnCVE-2019-08797.8A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database EnCVE-2019-08807.8A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls, aka 'Microsoft splwow64 Elevation of PrivilegCVE-2019-08817.8An elevation of privilege vulnerability exists when the Windows Kernel improperly handles key enumeration, aka 'Windows Kernel Elevation of CVE-2019-08826.5An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows CVE-2019-08847.5A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'ScriptingCVE-2019-08857.8A remote code execution vulnerability exists when Microsoft Windows OLE fails to properly validate user input, aka 'Windows OLE Remote Code CVE-2019-08866.8An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authCVE-2019-08878.0A remote code execution vulnerability exists in Remote Desktop Services - formerly known as Terminal Services - when an authenticated attack
CVE-2019-0872: Medium severity, CVSS 5.4 | Vulnix