Lucene search

AtlassianCVE-2018-20236

HistoryMar 08, 2019 - 6:29 p.m.

CVE-2018-20236

2019-03-0818:29:00

CWE-77

atlassian

web.nvd.nist.gov

cve-2018-20236

command injection

sourcetree

windows

uri handling

remote code execution

nvd

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

9.1

Confidence

High

EPSS

0.012

Percentile

85.6%

JSON

There was an command injection vulnerability in Sourcetree for Windows from version 0.5a before version 3.0.10 via URI handling. A remote attacker could send a malicious URI to a victim using Sourcetree for Windows to exploit this issue to gain code execution on the system.

Affected configurations

Nvd

Node

atlassiansourcetreeRange0.5a–3.0.10windows

VendorProductVersionCPE
atlassiansourcetree*cpe:2.3:a:atlassian:sourcetree:*:*:*:*:*:windows:*:*

Vendor	Product	Version	CPE
atlassian	sourcetree	*	cpe:2.3:a:atlassian:sourcetree::::::windows::*

CNA Affected

[
  {
    "product": "Sourcetree for Windows",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "0.5a",
        "versionType": "custom"
      },
      {
        "lessThan": "3.0.10",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

packetstormsecurity.com/files/152173/Sourcetree-Git-Arbitrary-Code-Execution-URL-Handling.html

www.securityfocus.com/bid/107401

jira.atlassian.com/browse/SRCTREEWIN-11291

seclists.org/bugtraq/2019/Mar/30

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

9.1

Confidence

High

EPSS

0.012

Percentile

85.6%

JSON

Related for CVE-2018-20236