CVE-2018-20236

2019-03-0600:00:00

atlassian

www.cve.org

9.5 High

AI Score

Confidence

High

0.013 Low

EPSS

Percentile

85.9%

JSON

There was an command injection vulnerability in Sourcetree for Windows from version 0.5a before version 3.0.10 via URI handling. A remote attacker could send a malicious URI to a victim using Sourcetree for Windows to exploit this issue to gain code execution on the system.

CNA Affected

[
  {
    "product": "Sourcetree for Windows",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "0.5a",
        "versionType": "custom"
      },
      {
        "lessThan": "3.0.10",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]