Vulnerabilities affecting this package (0)
| Vulnerability |
Summary |
Fixed by |
|
This package is not known to be affected by vulnerabilities.
|
Vulnerabilities fixed by this package (2)
| Vulnerability |
Summary |
Aliases |
|
VCID-62bs-bqfj-bubj
|
XXE vulnerability in Jenkins Mercurial Plugin
Jenkins Mercurial Plugin prior to 2.12, 2.10.1, 2.9.1, and 2.8.1 does not configure its XML changelog parser to prevent XML external entity (XXE) attacks.
This allows attackers able to control an agent process to have Jenkins parse a crafted changelog file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
Mercurial Plugin 2.12, 2.10.1, 2.9.1, and 2.8.1 disables external entity resolution for its XML parser.
|
CVE-2020-2305
GHSA-x58r-wxc3-7pqr
|
|
VCID-pdf8-znrf-3ffv
|
Missing Authorization in Jenkins Mercurial Plugin
Mercurial Plugin prior to 2.12, 2.10.1, 2.9.1, and 2.8.1 does not perform a permission check in an HTTP endpoint.
This allows attackers with Overall/Read permission to obtain a list of names of configured Mercurial installations.
Mercurial Plugin 2.12, 2.10.1, 2.9.1, and 2.8.1 performs permission checks when listing configured Mercurial installations.
|
CVE-2020-2306
GHSA-vrrc-3wwh-frgx
|