A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server does not properly sanitize user provided input, aka 'Azure DevOps Server Cross-site Scripting Vulnerability'.

The Microsoft Team Foundation Server or Azure DevOps Server is missing security updates. It is, therefore, affected by a cross-site scripting (XSS) vulnerability due to not properly sanitizing user-provided input. An authenticated, remote attacker can exploit this by sending a specially-crafted payload to the TFS or Azure DevOps server, which will get executed in the context of the user every time a user visits the compromised page.

Detections

Analytics

CVE-2020-1326

medium

Tenable Plugins

medium