CVE-2018-5226

8.8HIGH

Key Information:

Vendor
Atlassian
Status
Sourcetree Windows
Vendor
CVE Published:
25 April 2018

Summary

There was an argument injection vulnerability in Sourcetree for Windows via Mercurial repository tag name that is going to be deleted. An attacker with permission to create a tag on a Mercurial repository linked in Sourcetree for Windows is able to exploit this issue to gain code execution on the system. All versions of Sourcetree for Windows before 2.5.5.0 are affected by this vulnerability.

Affected Version(s)

SourceTree Windows < 2.5.5.0

References

https://jira.atlassian.com/browse/SRCTREEWIN-8509
x_refsource_CONFIRM

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.