CVE-2018-20235: Critical severity Atlassian Sourcetree Windows vulnerability
There was an argument injection vulnerability in Atlassian Sourcetree for Windows from version 0.5a before version 3.0.15 via filenames in Mercurial repositories. A remote attacker with permission to commit to a Mercurial repository linked in Sourcetree for Windows is able to exploit this issue to gain code execution on the system.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-20235?
CVE-2018-20235 is classified as a high severity vulnerability due to its potential to allow arbitrary code execution through argument injection.
How do I fix CVE-2018-20235?
To fix CVE-2018-20235, users should upgrade Atlassian Sourcetree to version 3.0.15 or later.
Who is affected by CVE-2018-20235?
CVE-2018-20235 affects all versions of Atlassian Sourcetree for Windows from 0.5a to less than 3.0.15.
What type of vulnerability is CVE-2018-20235?
CVE-2018-20235 is an argument injection vulnerability affecting Mercurial repository filenames.
Can CVE-2018-20235 be exploited remotely?
Yes, a remote attacker with commit permissions can exploit CVE-2018-20235 if the targeted Mercurial repository is linked in Sourcetree for Windows.