-
Bug
-
Resolution: Fixed
-
Highest
-
2.6.9
-
None
-
Severity 1 - Critical
There was an argument injection vulnerability in Sourcetree for Windows from version 0.5.1.0 before version 3.0.0 via Git subrepositories in Mercurial repositories. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for Windows is able to exploit this issue to gain code execution on the system.
For additional details, see the full advisory
- is related to
-
-
- Closed
-
[SRCTREEWIN-9077] Remote Code Execution in Sourcetree for Windows, via Mercurial repo with Git subrepo - CVE-2018-13397
| Workflow | Original: JAC Bug Workflow v3 [ 3454480 ] | New: SRCTREE JAC Bug Workflow [ 3743717 ] |
| Workflow | Original: SourceTree Bug Workflow [ 2771142 ] | New: JAC Bug Workflow v3 [ 3454480 ] |
| Status | Original: Resolved [ 5 ] | New: Closed [ 6 ] |
| Labels | Original: CVE-2018-13397 advisory advisory-to-release bugbounty cvss-critical rce security | New: CVE-2018-13397 advisory advisory-released bugbounty cvss-critical rce security |
| Description |
Original:
There was an argument injection vulnerability in Sourcetree for Windows from version 0.5.1.0 before version 3.0.0 , via Git subrepositories in Mercurial repositories. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for Windows is able to exploit this issue to gain code execution on the system.
For additional details, see the [full advisory|https://confluence.atlassian.com/x/v00SOQ] |
New:
There was an argument injection vulnerability in Sourcetree for Windows from version 0.5.1.0 before version 3.0.0 via Git subrepositories in Mercurial repositories. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for Windows is able to exploit this issue to gain code execution on the system.
For additional details, see the [full advisory|https://confluence.atlassian.com/x/v00SOQ] |
| Description |
Original:
There was an argument injection vulnerability in Atlassian SourceTree for Windows from version 0.5.1.0 before version 3.0.0 , via Git subrepositories in Mercurial repositories. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for Windows is able to exploit this issue to gain code execution on the system.
For additional details, see the [full advisory|https://confluence.atlassian.com/x/v00SOQ] |
New:
There was an argument injection vulnerability in Sourcetree for Windows from version 0.5.1.0 before version 3.0.0 , via Git subrepositories in Mercurial repositories. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for Windows is able to exploit this issue to gain code execution on the system.
For additional details, see the [full advisory|https://confluence.atlassian.com/x/v00SOQ] |
| Description |
Original:
Component in Atlassian SourceTree for Windows from version 0.5.1.0 before version 3.0.0 allows remote attackers to execute code of their choice via a remote code execution vulnerability.
For additional details, see the [full advisory|https://confluence.atlassian.com/x/v00SOQ] |
New:
There was an argument injection vulnerability in Atlassian SourceTree for Windows from version 0.5.1.0 before version 3.0.0 , via Git subrepositories in Mercurial repositories. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for Windows is able to exploit this issue to gain code execution on the system.
For additional details, see the [full advisory|https://confluence.atlassian.com/x/v00SOQ] |
| Security | Original: Atlassian Staff [ 10750 ] |
| Due Date | Original: 25/Sep/2018 | New: 24/Oct/2018 |
| Description |
Original:
Component in Atlassian SourceTree for Windows from version 0.5.1.0 before version 3.0.0 allows remote attackers to execute code of their choice via a remote code execution vulnerability.
For additional details, see the full advisory: [https://confluence.atlassian.com/x/v00SOQ] |
New:
Component in Atlassian SourceTree for Windows from version 0.5.1.0 before version 3.0.0 allows remote attackers to execute code of their choice via a remote code execution vulnerability.
For additional details, see the [full advisory|https://confluence.atlassian.com/x/v00SOQ] |
| Description |
Original:
Component in Atlassian SourceTree for Windows from version 0.5.1.0 before version 3.0.0 allows remote attackers to execute code of their choice via a remote code execution vulnerability.
For additional details, see the full advisory: [https://confluence.atlassian.com/display/SOURCETREEKB/Sourcetree+Security+Advisory+2018-10-03] |
New:
Component in Atlassian SourceTree for Windows from version 0.5.1.0 before version 3.0.0 allows remote attackers to execute code of their choice via a remote code execution vulnerability.
For additional details, see the full advisory: [https://confluence.atlassian.com/x/v00SOQ] |