{"containers": {"cna": {"affected": [{"product": "Sourcetree for Windows", "vendor": "Atlassian", "versions": [{"lessThan": "unspecified", "status": "affected", "version": "0.5a", "versionType": "custom"}, {"lessThan": "3.0.10", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "datePublic": "2019-03-06T00:00:00", "descriptions": [{"lang": "en", "value": "There was an command injection vulnerability in Sourcetree for Windows from version 0.5a before version 3.0.10 via URI handling. A remote attacker could send a malicious URI to a victim using Sourcetree for Windows to exploit this issue to gain code execution on the system."}], "problemTypes": [{"descriptions": [{"description": "Command Injection", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-03-21T15:06:05", "orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "shortName": "atlassian"}, "references": [{"name": "107401", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/107401"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://jira.atlassian.com/browse/SRCTREEWIN-11291"}, {"name": "20190320 March 2019 Sourcetree Advisory - Multiple Remote Code Execution Vulnerabilities", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "https://seclists.org/bugtraq/2019/Mar/30"}, {"tags": ["x_refsource_MISC"], "url": "http://packetstormsecurity.com/files/152173/Sourcetree-Git-Arbitrary-Code-Execution-URL-Handling.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@atlassian.com", "DATE_PUBLIC": "2019-03-06T00:00:00", "ID": "CVE-2018-20236", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Sourcetree for Windows", "version": {"version_data": [{"version_affected": ">=", "version_value": "0.5a"}, {"version_affected": "<", "version_value": "3.0.10"}]}}]}, "vendor_name": "Atlassian"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "There was an command injection vulnerability in Sourcetree for Windows from version 0.5a before version 3.0.10 via URI handling. A remote attacker could send a malicious URI to a victim using Sourcetree for Windows to exploit this issue to gain code execution on the system."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Command Injection"}]}]}, "references": {"reference_data": [{"name": "107401", "refsource": "BID", "url": "http://www.securityfocus.com/bid/107401"}, {"name": "https://jira.atlassian.com/browse/SRCTREEWIN-11291", "refsource": "CONFIRM", "url": "https://jira.atlassian.com/browse/SRCTREEWIN-11291"}, {"name": "20190320 March 2019 Sourcetree Advisory - Multiple Remote Code Execution Vulnerabilities", "refsource": "BUGTRAQ", "url": "https://seclists.org/bugtraq/2019/Mar/30"}, {"name": "http://packetstormsecurity.com/files/152173/Sourcetree-Git-Arbitrary-Code-Execution-URL-Handling.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/152173/Sourcetree-Git-Arbitrary-Code-Execution-URL-Handling.html"}]}}}}, "cveMetadata": {"assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66", "assignerShortName": "atlassian", "cveId": "CVE-2018-20236", "datePublished": "2019-03-06T00:00:00", "dateReserved": "2018-12-19T00:00:00", "dateUpdated": "2019-03-21T15:06:05", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:atlassian:sourcetree:*:*:*:*:*:windows:*:*", "matchCriteriaId": "7C4F03AA-02DC-461D-89DE-6FFA1EDCA825", "versionEndExcluding": "3.0.10", "versionStartIncluding": "0.5a", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "There was an command injection vulnerability in Sourcetree for Windows from version 0.5a before version 3.0.10 via URI handling. A remote attacker could send a malicious URI to a victim using Sourcetree for Windows to exploit this issue to gain code execution on the system."}, {"lang": "es", "value": "Hab\u00eda una vulnerabilidad de inyecci\u00f3n de comandos en Sourcetree para Windows, desde la versi\u00f3n 0.5a hasta la 3.0.10, mediante la gesti\u00f3n de URI. Un atacante remoto podr\u00eda enviar una URL maliciosa a una v\u00edctima que utiliza Sourcetree para Windows para explotar este fallo con el fin obtener la ejecuci\u00f3n de c\u00f3digo en el sistema."}], "id": "CVE-2018-20236", "lastModified": "2019-10-03T00:03:26.223", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 9.3, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-03-08T18:29:00.320", "references": [{"source": "security@atlassian.com", "url": "http://packetstormsecurity.com/files/152173/Sourcetree-Git-Arbitrary-Code-Execution-URL-Handling.html"}, {"source": "security@atlassian.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/107401"}, {"source": "security@atlassian.com", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://jira.atlassian.com/browse/SRCTREEWIN-11291"}, {"source": "security@atlassian.com", "url": "https://seclists.org/bugtraq/2019/Mar/30"}], "sourceIdentifier": "security@atlassian.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}