What’s Vulnerable › Vulnerabilities

CVE-2010-3199

• Severity: critical (CVSS 9.3 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2010-09-10 · updated 2026-06-16
• Weakness: CWE-264

Description

Untrusted search path vulnerability in TortoiseSVN 1.6.10, Build 19898 and earlier allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same folder as a file that is processed by Tortoise. NOTE: this is only a vulnerability when a file extension is associated with TortoiseProc or TortoiseMerge, which is not the default.

Affected products

• Tigris Tortoisesvn: through 1.6.10; 0.1, 0.2, 0.3, 0.4, 0.5, 0.5.1 (+92)

References

• http://tortoisesvn.tigris.org/ds/viewMessage.do?dsForumId=4061&dsMessageId=2653163
• http://tortoisesvn.tigris.org/ds/viewMessage.do?dsForumId=4061&dsMessageId=2653202&orderBy=createDate&orderType=desc
• http://www.securityfocus.com/archive/1/513442/100/0/threaded
• http://www.securityfocus.com/archive/1/513463/100/0/threaded
• http://tortoisesvn.tigris.org/ds/viewMessage.do?dsForumId=4061&dsMessageId=2653163
• http://tortoisesvn.tigris.org/ds/viewMessage.do?dsForumId=4061&dsMessageId=2653202&orderBy=createDate&orderType=desc
• http://www.securityfocus.com/archive/1/513442/100/0/threaded
• http://www.securityfocus.com/archive/1/513463/100/0/threaded

Get alerted when CVE-2010-3199 or the next vulnerability affects your stack