CVE-2023-36869: Azure DevOps Server Spoofing Vulnerability

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?

An attacker would have to send the victim a malicious link that the victim would have to click for a successful attack.