CVE-2018-20236

2019-03-0818:00:00

atlassian

www.cve.org

AI Score

9.5

Confidence

High

EPSS

0.012

Percentile

85.6%

JSON

There was an command injection vulnerability in Sourcetree for Windows from version 0.5a before version 3.0.10 via URI handling. A remote attacker could send a malicious URI to a victim using Sourcetree for Windows to exploit this issue to gain code execution on the system.

CNA Affected

[
  {
    "product": "Sourcetree for Windows",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "0.5a",
        "versionType": "custom"
      },
      {
        "lessThan": "3.0.10",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]