Uploaded image for project: 'Sourcetree For Mac'
  1. Sourcetree For Mac
  2. SRCTREE-4481

Shell Injection in SourceTree for Mac

XMLWordPrintable

    • Severity 2 - Major

      SourceTree for Mac had a shell injection vulnerability starting with 1.9.8 prior to 2.3.1 (the fixed version). By visiting a malicious website or by convincing a user to click a sourcetree:// URL with a vulnerable version of SourceTree for Mac installed an attacker could use a shell injection vulnerability to execute arbitrary commands on a victims machine.

       

      Affected versions:

      • All versions of SourceTree for Mac from 1.9.8 before 2.3.1 (the fixed version) are affected by this vulnerability. 

      Fix:

       

      Acknowledgements:

      We would like to credit Matthew Diaz of NCC Group Security Advisory for reporting this issue to us.

            [SRCTREE-4481] Shell Injection in SourceTree for Mac

            David Black added a comment -

            CVSS v3 score: 9.6 => Critical severity

            Exploitability Metrics

            Attack Vector Network
            Attack Complexity Low
            Privileges Required None
            User Interaction Required

            Scope Metric

            Scope Changed

            Impact Metrics

            Confidentiality High
            Integrity High
            Availability High

            David Black added a comment - CVSS v3 score: 9.6 => Critical severity Exploitability Metrics Attack Vector Network Attack Complexity Low Privileges Required None User Interaction Required Scope Metric Scope Changed Impact Metrics Confidentiality High Integrity High Availability High

              Unassigned Unassigned
              dblack David Black
              Affected customers:
              0 This affects my team
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved: