1. Home
  2. Security Advisories
  3. Jenkins
  4. JENKINS:SECURITY-2104

[JENKINS:SECURITY-2104] Missing permission check in `mercurial`

Severity Medium
Affected Packages 2
Fixed Packages 2
CVEs 1
Info Packages References Vulnerabilities

mercurial 2.11 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to obtain a list of names of configured Mercurial installations.

mercurial 2.12 performs permission checks when listing configured Mercurial installations.

Package Affected Version
pkg:maven/org.jenkins-ci.plugins/mercurial <= 2.11
pkg:github/jenkinsci/mercurial-plugin <= 2.11
Package Fixed Version
pkg:maven/org.jenkins-ci.plugins/mercurial = 2.12
pkg:github/jenkinsci/mercurial-plugin = 2.12
ID
JENKINS:SECURITY-2104
Severity
medium
Published
2020-11-04T00:00:00
(3 years ago)
Modified
2020-11-04T00:00:00
(3 years ago)
Rights
Jenkins Security Team
Other Advisories
Source # ID Name URL
Plugin repository mercurial repository https://github.com/jenkinsci/mercurial-plugin
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:maven/org.jenkins-ci.plugins/mercurial org.jenkins-ci.plugins mercurial <= 2.11
Fixed pkg:maven/org.jenkins-ci.plugins/mercurial org.jenkins-ci.plugins mercurial = 2.12
Affected pkg:github/jenkinsci/mercurial-plugin jenkinsci mercurial-plugin <= 2.11
Fixed pkg:github/jenkinsci/mercurial-plugin jenkinsci mercurial-plugin = 2.12
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date