9.8

CVE-2018-13385

There was an argument injection vulnerability in Sourcetree for macOS via filenames in Mercurial repositories. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for macOS is able to exploit this issue to gain code execution on the system. Versions of Sourcetree for macOS from 1.0b2 before 2.7.6 are affected by this vulnerability.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Atlassian ≫ Sourcetree SwPlatform mac_os_x Version >= 1.0 < 2.7.6
Atlassian ≫ Sourcetree Version 1.0 Update beta2 SwPlatform macos
Atlassian ≫ Sourcetree Version 1.0 Update beta3 SwPlatform macos
Atlassian ≫ Sourcetree Version 1.0 Update beta4 SwPlatform macos
Atlassian ≫ Sourcetree Version 1.0 Update beta5 SwPlatform macos
Atlassian ≫ Sourcetree Version 1.0 Update rc1 SwPlatform macos
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.21% 0.803
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

https://jira.atlassian.com/browse/SRCTREE-5846
Vendor Advisory