Test ID:	1.3.6.1.4.1.25623.1.0.107701
Category:	General
Title:	TortoiseSVN <= 1.12.1 RCE Vulnerability
Summary:	TortoiseSVN is prone to a remote code execution (RCE); vulnerability.
Description:	Summary: TortoiseSVN is prone to a remote code execution (RCE) vulnerability. Vulnerability Insight: These vulnerabilities exist: - The URI handler of TortoiseSVN (Tsvncmd:) allows a customised diff operation on Excel workbooks, which could be used to open remote workbooks without protection from macro security settings. - The `tsvncmd:command:diff?path:[file1]?path2:[file2]` will execute a customised diff on [file1] and [file2] based on the file extension. For xls files, it will execute the script `diff-xls.js` using wscript, which will open the two files for analysis without any macro security warning. Vulnerability Impact: Successful exploitation could allow remote attackers to execute arbitrary code to compromise the target system. Affected Software/OS: TortoiseSVN through version 1.12.1. Solution: Update to version 1.12.2 or later. CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2019-14422 http://seclists.org/fulldisclosure/2019/Aug/7 https://www.vulnerability-lab.com/get_content.php?id=2188
Copyright	Copyright (C) 2019 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.