CVE-2018-13396: Critical severity sourcetree vulnerability
There was an argument injection vulnerability in Sourcetree for macOS from version 1.0b2 before version 3.0.0 via Git subrepositories in Mercurial repositories. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for macOS is able to exploit this issue to gain code execution on the system.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-13396?
CVE-2018-13396 is classified as a medium severity vulnerability.
How do I fix CVE-2018-13396?
To fix CVE-2018-13396, upgrade to Atlassian Sourcetree version 3.0.0 or later.
Who is affected by CVE-2018-13396?
CVE-2018-13396 affects all versions of Atlassian Sourcetree for macOS from 1.0b2 up to, but not including, 3.0.0.
What is the nature of the CVE-2018-13396 vulnerability?
CVE-2018-13396 is an argument injection vulnerability that allows an attacker to gain code execution via Git subrepositories in Mercurial repositories.
Can CVE-2018-13396 be exploited remotely?
CVE-2018-13396 requires that the attacker has commit permissions to a Mercurial repository, thus it cannot be exploited remotely without such access.