CVE-2017-8768
CriticalSummary
Atlassian SourceTree v2.5c and prior are affected by a command injection in the handling of the sourcetree:// scheme. It will lead to arbitrary OS command execution with a URL substring of sourcetree://cloneRepo/ext:: or sourcetree://checkoutRef/ext:: followed by the command.
Risk Assessment
Exploitation of this vulnerability could allow attackers to execute arbitrary commands on the operating system, posing a serious security threat to the organization.
Recommendation
It is recommended to update Atlassian SourceTree to the latest version to mitigate this vulnerability and to monitor systems for unauthorized activities.
Original NVD description (English source)
Atlassian SourceTree v2.5c and prior are affected by a command injection in the handling of the sourcetree:// scheme. It will lead to arbitrary OS command execution with a URL substring of sourcetree://cloneRepo/ext:: or sourcetree://checkoutRef/ext:: followed by the command. The Atlassian ID number is SRCTREE-4632.