Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2018-13385

There was an argument injection vulnerability in Sourcetree for macOS via filenames in Mercurial repositories. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for macOS is able to exploit this issue to gain code execution on the system. Versions of Sourcetree for macOS from 1.0b2 before 2.7.6 are affected by this vulnerability.

Published

2018-07-24T13:29:00.497

Last Modified

2024-11-21T03:47:00.070

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-88
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application atlassian sourcetree < 2.7.6 Yes
Application atlassian sourcetree 1.0 Yes
Application atlassian sourcetree 1.0 Yes
Application atlassian sourcetree 1.0 Yes
Application atlassian sourcetree 1.0 Yes
Application atlassian sourcetree 1.0 Yes
References