CVE-2017-8768

CWE-78 — OS Command Injection3 documents3 sources
Severity
9.8CRITICAL
EPSS
8.0%
top 7.89%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Atlassian Sourcetree
Timeline
PublishedMay 4
Latest updateMay 17

Description

Atlassian SourceTree v2.5c and prior are affected by a command injection in the handling of the sourcetree:// scheme. It will lead to arbitrary OS command execution with a URL substring of sourcetree://cloneRepo/ext:: or sourcetree://checkoutRef/ext:: followed by the command. The Atlassian ID number is SRCTREE-4632.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-pf5p-r5w7-3r8g: Atlassian SourceTree v2↗2022-05-17
▶
CVEList
CVE-2017-8768: Atlassian SourceTree v2↗2017-05-04
▶
CVE-2017-8768 (CRITICAL CVSS 9.8) | Atlassian SourceTree v2.5c and prio | cvebase.io