CVE-2018-13385: Critical severity Atlassian Sourcetree Mac Os X vulnerability
There was an argument injection vulnerability in Sourcetree for macOS via filenames in Mercurial repositories. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for macOS is able to exploit this issue to gain code execution on the system. Versions of Sourcetree for macOS from 1.0b2 before 2.7.6 are affected by this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-13385?
CVE-2018-13385 is rated as a critical vulnerability due to the potential for remote code execution.
How do I fix CVE-2018-13385?
To fix CVE-2018-13385, upgrade to the latest version of Atlassian Sourcetree that addresses this vulnerability.
Who is affected by CVE-2018-13385?
Users of Atlassian Sourcetree for macOS versions between 1.0 and 2.7.6 are affected by CVE-2018-13385.
What kind of attack is possible with CVE-2018-13385?
An attacker can exploit CVE-2018-13385 to gain unauthorized code execution on the affected system.
Is user intervention required to exploit CVE-2018-13385?
Yes, the attacker would need permission to commit to a Mercurial repository linked in Sourcetree to exploit CVE-2018-13385.