CVE-2018-8529 Missing authorization in Team

What is CVE-2018-8529?

CVE-2018-8529 is a critical missing authorization vulnerability in Microsoft Team, published on 15 Nov 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A remote code execution vulnerability exists when Team Foundation Server (TFS) does not enable basic authorization on the communication between the TFS and Search services, aka "Team Foundation Server Remote Code Execution Vulnerability." This affects Team.

Which versions are affected by CVE-2018-8529?

It affects 1 product.

Products include Microsoft Team Foundation Server.

How do I fix CVE-2018-8529?

No fix has been published for CVE-2018-8529 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2018-8529 being exploited?

There is no known exploitation of CVE-2018-8529 in the wild and no public exploit code.

Other vulnerabilities in Microsoft Team

• CVE-2019-0647 Information disclosure in Team Medium 6.5
• CVE-2019-0777 Cross-site scripting in Team Foundation Server Medium 5.4
• CVE-2019-0742 Cross-site scripting in Team Foundation Server 2018 Medium 5.4
• CVE-2019-0743 Cross-site scripting in Team Foundation Server 2018 Medium 5.4
• CVE-2019-0646 Cross-site scripting in Team Medium 5.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-g635-3cv2-g7jq.