GHSA-vrrc-3wwh-frgxMediumCVSS 4.3

Missing Authorization in Jenkins Mercurial Plugin

Published
May 24, 2022
Last Modified
December 14, 2023

🔗 CVE IDs covered (1)

CVE-2020-2306 →

📋 Description

Mercurial Plugin prior to 2.12, 2.10.1, 2.9.1, and 2.8.1 does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to obtain a list of names of configured Mercurial installations.

Mercurial Plugin 2.12, 2.10.1, 2.9.1, and 2.8.1 performs permission checks when listing configured Mercurial installations.

🎯 Affected products4

  • maven/org.jenkins-ci.plugins:mercurial:= 2.11
  • maven/org.jenkins-ci.plugins:mercurial:= 2.10
  • maven/org.jenkins-ci.plugins:mercurial:= 2.9
  • maven/org.jenkins-ci.plugins:mercurial:< 2.8.1

🔗 References (5)