Skip to main content

Sourcetree CVE-2019-11582

HIGH
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)
2019-06-14 security@atlassian.com
Atlassian Microsoft RCE Sourcetree
8.8
CVSS 3.0 · NVD
Share

Severity by source

NVD PRIMARY
8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Jun 14, 2019 - 14:29 nvd
HIGH 8.8

DescriptionNVD

An argument injection vulnerability in Atlassian Sourcetree for Windows's URI handlers, in all versions prior to 3.1.3, allows remote attackers to gain remote code execution through the use of a crafted URI.

AnalysisAI

An argument injection vulnerability in Atlassian Sourcetree for Windows's URI handlers, in all versions prior to 3.1.3, allows remote attackers to gain remote code execution through the use of a. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-88. An argument injection vulnerability in Atlassian Sourcetree for Windows's URI handlers, in all versions prior to 3.1.3, allows remote attackers to gain remote code execution through the use of a crafted URI. Affected products include: Atlassian Sourcetree. Version information: prior to 3.1.3.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Sourcetree

View all
CVE-2017-8768 CRITICAL
9.8 May 04

Atlassian SourceTree v2.5c and prior are affected by a command injection in the handling of the sourcetree:// scheme. Ra
CVE-2018-13385 CRITICAL
9.8 Jul 24

There was an argument injection vulnerability in Sourcetree for macOS via filenames in Mercurial repositories. Rated cri
CVE-2024-21697 HIGH
8.8 Nov 19

This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 4.2.8 of Sourcetree for Mac and

CVE-2018-13397 HIGH
8.8 Nov 05

There was an argument injection vulnerability in Sourcetree for Windows from version 0.5.1.0 before version 3.0.0 via Gi
CVE-2018-13396 HIGH
8.8 Nov 05

There was an argument injection vulnerability in Sourcetree for macOS from version 1.0b2 before version 3.0.0 via Git su
CVE-2018-5226 HIGH
8.8 Apr 25

There was an argument injection vulnerability in Sourcetree for Windows via Mercurial repository tag name that is going

CVE-2018-13386 HIGH
8.1 Jul 24

There was an argument injection vulnerability in Sourcetree for Windows via filenames in Mercurial repositories. Rated h

Same weakness CWE-88 – Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

View all
CVE-2016-10033 CRITICAL POC
9.8
CVE-2026-24061 CRITICAL POC
9.8
CVE-2025-57791 MEDIUM POC
6.9
CVE-2018-17456 CRITICAL POC
9.8
CVE-2018-19518 HIGH POC
7.5
CVE-2025-70327 CRITICAL POC
9.8
CVE-2020-5792 HIGH POC
7.2
CVE-2024-39930 CRITICAL POC
9.9

Same technique RCE

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2025-53770 CRITICAL POC
9.8
CVE-2020-7961 CRITICAL POC
9.8

Share

CVE-2019-11582 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy