Microsoft Team Foundation Server CVE-2019-0742 Cross Site Scripting Vulnerability

Bugtraq ID:	106967
Class:	Input Validation Error
CVE:	CVE-2019-0742
Remote:	Yes
Local:	No
Published:	Feb 12 2019 12:00AM
Updated:	Feb 12 2019 12:00AM
Credit:	Junyu Zhou(@md5_salt) from Tencent Security Xuanwu Lab.
Vulnerable:	Microsoft Team Foundation Server 2018 Update 3.2
Not Vulnerable:

Microsoft Team Foundation Server CVE-2019-0742 Cross Site Scripting Vulnerability

Microsoft Team Foundation Server is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to insert and display spoofed content and to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to perform unauthorized actions such as reading, modifying, or deleting content on behalf of the victim on the affected application.

Microsoft Team Foundation Server CVE-2019-0742 Cross Site Scripting Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Microsoft Team Foundation Server CVE-2019-0742 Cross Site Scripting Vulnerability

References:

• Microsoft Homepage (Microsoft)
  
• CVE-2019-0742 | Team Foundation Server Cross-site Scripting Vulnerability (Microsoft)