CVE-2010-3199 - CVE House
Back to Database
Status published Critical CVE-2010-3199

Untrusted search path vulnerability in TortoiseSVN 1.6.10, Build 19898 and...

Vulnerability Description

Untrusted search path vulnerability in TortoiseSVN 1.6.10, Build 19898 and earlier allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same folder as a file that is processed by Tortoise. NOTE: this is only a vulnerability when a file extension is associated with TortoiseProc or TortoiseMerge, which is not the default.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2010-3199

Credits & Attribution

No credits recorded in the NVD database.

References

More from tigris

View All →
CVE-2009-0240
listing.php in WebSVN 2.0 and possibly 1.7 beta, when using...
Low 3.5
CVE-2008-5920
The create_anchors function in utils.inc in WebSVN 1.x allows remote...
High 7.5
CVE-2008-5919
Directory traversal vulnerability in rss.php in WebSVN 2.0 and earlier,...
Medium 6.8
CVE-2008-5918
Cross-site scripting (XSS) vulnerability in the getParameterisedSelfUrl function in index.php...
Medium 4.3

Affected Vendor

Affected Software

tortoisesvn
Vulnerable Versions:
0, 0.1, 0.2, 0.3, 0.4, 0.5, 0.5.1, 0.6, 0.6.1, 0.7, 0.8, 0.8.1, 0.9.1, 0.9.2, 0.10.0, 0.11.0, 0.11.2, 0.12, 0.12.1, 0.14, 0.15, 0.15.1, 0.15.2, 0.16, 0.17, 0.18, 0.19, 0.20, 0.20.1, 0.20.2, 0.21, 0.22, 0.23, 0.24, 0.25, 0.26, 1.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.1.6, 1.1.7, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5, 1.2.6, 1.3.0, 1.3.1, 1.3.2, 1.3.3, 1.3.4, 1.3.5, 1.4.0, 1.4.1, 1.4.2, 1.4.3, 1.4.4, 1.4.5, 1.4.6, 1.4.7, 1.4.8, 1.5.0, 1.5.1, 1.5.2, 1.5.3, 1.5.4, 1.5.5, 1.5.6, 1.5.7, 1.5.8, 1.5.9, 1.5.10, 1.6.0, 1.6.3, 1.6.4, 1.6.5, 1.6.6

Timeline

Official Publish: September 10th, 2010
Last Modified: August 7th, 2024
Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.