CVE-2019-1072

Estado: ModificadaCrítica (9.8)—

A remote code execution vulnerability exists when Azure DevOps Server and Team Foundation Server (TFS) improperly handle user input, aka 'Azure DevOps Server and Team Foundation Server Remote Code Execution Vulnerability'.

CVSS

Versión: 3.0
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 9.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 13%
Percentil entre todas las CVEs puntuadas: 96
Fecha de la puntuación: 4/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Microsoft — Azure Devops Server Microsoft — Team Foundation Server

CWE

CWE-20

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2019-1072",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "Microsoft",
          "product": "Team Foundation Server 2012",
          "versions": [
            {
              "status": "affected",
              "version": "Update 4"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Team Foundation Server 2013 Update 5",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Team Foundation Server 2018",
          "versions": [
            {
              "status": "affected",
              "version": "Update 1.2"
            },
            {
              "status": "affected",
              "version": "Update 3.2"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Team Foundation Server",
          "versions": [
            {
              "status": "affected",
              "version": "2017 Update 3.1"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Team Foundation Server 2015",
          "versions": [
            {
              "status": "affected",
              "version": "Update 4.2"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Azure DevOps Server",
          "versions": [
            {
              "status": "affected",
              "version": "2019.0.1"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Team Foundation Server 2010",
          "versions": [
            {
              "status": "affected",
              "version": "SP1 (x86)"
            },
            {
              "status": "affected",
              "version": "SP1 (x64)"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-07-15T19:15:17.123",
  "references": [
    {
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1072",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1072",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A remote code execution vulnerability exists when Azure DevOps Server and Team Foundation Server (TFS) improperly handle user input, aka 'Azure DevOps Server and Team Foundation Server Remote Code Execution Vulnerability'."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de ejecución de código remota cuando Azure DevOps Server y Team Foundation Server (TFS), manejan inapropiadamente las entradas de los usuarios, también se conoce como \"Azure DevOps Server and Team Foundation Server Remote Code Execution Vulnerability\"."
    }
  ],
  "lastModified": "2026-06-17T02:27:45.940",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:team_foundation_server:2010:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D1C2DF25-1987-49AC-9EAD-977A2FBDD8A7"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:team_foundation_server:2012:4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EADE894D-B823-488E-AD02-731D86C23D6B"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:team_foundation_server:2013:5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FD7985FC-BCCB-48B3-AC5E-EE4B9D842EB9"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:team_foundation_server:2015:4.2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CCCD9300-295F-4D45-9A34-949F33971974"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:team_foundation_server:2017:3.1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C6AE94A8-76A3-4998-A7B4-60EA21530F3D"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:team_foundation_server:2018:1.2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5F78642D-BE17-43A9-97E4-042EDE627678"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:team_foundation_server:2018:3.2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5296DF6D-D32A-4D70-9A32-441750704C9A"
            },
            {
              "criteria": "cpe:2.3:o:microsoft:azure_devops_server:2019.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CE7EFADB-24D4-4DB7-A9E5-9C93F1286232"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@microsoft.com"
}