CVE-2019-0971 Information disclosure in Azure DevOps Server

What is CVE-2019-0971?

CVE-2019-0971 is a medium-severity vulnerability in Microsoft Azure DevOps Server, published on 16 May 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An information disclosure vulnerability exists when Azure DevOps Server and Microsoft Team Foundation Server do not properly sanitize a specially crafted authentication request to an affected server, aka 'Azure DevOps Server and Team Foundation Server Information Disclosure Vulnerability'.

Weakness: CWE-116

Which versions are affected by CVE-2019-0971?

It affects 2 products.

Products include Microsoft Azure Devops Server, Microsoft Team Foundation Server.

How do I fix CVE-2019-0971?

No fix has been published for CVE-2019-0971 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-0971 being exploited?

There is no known exploitation of CVE-2019-0971 in the wild and no public exploit code.

Other vulnerabilities in Microsoft Azure DevOps Server

• CVE-2019-1306 Code injection in Azure DevOps Server Critical 9.8
• CVE-2019-1072 Code injection in Azure DevOps Server Critical 9.8
• CVE-2023-33136 Azure DevOps Server Remote Code Execution Vulnerability High 8.8
• CVE-2024-35266 Azure DevOps Server Spoofing Vulnerability High 7.6
• CVE-2024-35267 Azure DevOps Server Spoofing Vulnerability High 7.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-858j-7757-pwv6.