Command Injection Vulnerability in Sourcetree for Windows
CVE-2018-20236

8.8HIGH

Key Information:

Vendor

Atlassian
Status
Sourcetree For Windows
Vendor
CVE Published:
8 March 2019

What is CVE-2018-20236?

A command injection vulnerability exists in Sourcetree for Windows that permits remote attackers to send crafted URIs, leading to arbitrary code execution. Affected users running versions from 0.5a up to 3.0.9 are at risk, as the vulnerability arises from improper URI handling within the application. Malicious actors can exploit this flaw by delivering specially designed URIs to victims, which Sourcetree processes, potentially compromising the victim's system.

Affected Version(s)

Sourcetree for Windows 0.5a

Sourcetree for Windows < 3.0.10

References

http://www.securityfocus.com/bid/107401
vdb-entryx_refsource_BID
https://jira.atlassian.com/browse/SRCTREEWIN-11291
x_refsource_CONFIRM
https://seclists.org/bugtraq/2019/Mar/30
mailing-listx_refsource_BUGTRAQ

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.