CVE-2017-14593: Command Injection
Sourcetree for Windows had several argument and command injection bugs in Mercurial and Git repository handling. An attacker with permission to commit to a repository linked in Sourcetree for Windows is able to exploit this issue to gain code execution on the system. From version 0.8.4b of Sourcetree for Windows, this vulnerability can be triggered from a webpage through the use of the Sourcetree URI handler. Versions of Sourcetree for Windows starting with 0.5.1.0 before version 2.4.7.0 are affected by this vulnerability
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-14593?
CVE-2017-14593 is considered a high severity vulnerability due to the potential for code execution on affected systems.
How do I fix CVE-2017-14593?
To mitigate CVE-2017-14593, update Sourcetree for Windows to a version later than 2.4.7.0.
Who is affected by CVE-2017-14593?
Users of Sourcetree for Windows versions from 0.5.1.0 to 2.4.7.0 are affected by CVE-2017-14593.
What types of attacks are possible with CVE-2017-14593?
CVE-2017-14593 allows an attacker with commit permissions to exploit repository handling vulnerabilities to execute arbitrary code.
Is CVE-2017-14593 specific to any version of Sourcetree?
Yes, CVE-2017-14593 specifically affects versions of Sourcetree for Windows from 0.5.1.0 to 2.4.7.0.