Atlassian SourceTree v2.5c and prior are affected by a command injection in the handling of the sourcetree:// scheme. It will lead to arbitrary OS command execution with a URL substring of sourcetree://cloneRepo/ext:: or sourcetree://checkoutRef/ext:: followed by the command. The Atlassian ID number is SRCTREE-4632.
References
| Link | Resource |
|---|---|
| http://openwall.com/lists/oss-security/2017/05/03/5 | Mailing List Third Party Advisory |
| http://seclists.org/fulldisclosure/2017/May/10 | Mailing List Third Party Advisory |
| http://www.securityfocus.com/bid/98329 | Third Party Advisory VDB Entry |
| https://www.youtube.com/watch?v=SQ1_Ht-0Bdo | Third Party Advisory |
| http://openwall.com/lists/oss-security/2017/05/03/5 | Mailing List Third Party Advisory |
| http://seclists.org/fulldisclosure/2017/May/10 | Mailing List Third Party Advisory |
| http://www.securityfocus.com/bid/98329 | Third Party Advisory VDB Entry |
| https://www.youtube.com/watch?v=SQ1_Ht-0Bdo | Third Party Advisory |
Configurations
History
21 Nov 2024, 03:34
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://openwall.com/lists/oss-security/2017/05/03/5 - Mailing List, Third Party Advisory | |
| References | () http://seclists.org/fulldisclosure/2017/May/10 - Mailing List, Third Party Advisory | |
| References | () http://www.securityfocus.com/bid/98329 - Third Party Advisory, VDB Entry | |
| References | () https://www.youtube.com/watch?v=SQ1_Ht-0Bdo - Third Party Advisory |
Information
Published : 2017-05-04 22:29
Updated : 2024-11-21 03:34
NVD link : CVE-2017-8768
Mitre link : CVE-2017-8768
CVE.ORG link : CVE-2017-8768
JSON object : View
Products Affected
atlassian
- sourcetree
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')