Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-pdf8-znrf-3ffv
Vulnerability ID VCID-pdf8-znrf-3ffv
Aliases CVE-2020-2306
GHSA-vrrc-3wwh-frgx
Summary Missing Authorization in Jenkins Mercurial Plugin Mercurial Plugin prior to 2.12, 2.10.1, 2.9.1, and 2.8.1 does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to obtain a list of names of configured Mercurial installations. Mercurial Plugin 2.12, 2.10.1, 2.9.1, and 2.8.1 performs permission checks when listing configured Mercurial installations.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-862 Missing Authorization
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 4.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-2306.json
epss 0.00064 https://api.first.org/data/v1/epss?cve=CVE-2020-2306
epss 0.00064 https://api.first.org/data/v1/epss?cve=CVE-2020-2306
epss 0.00064 https://api.first.org/data/v1/epss?cve=CVE-2020-2306
epss 0.00064 https://api.first.org/data/v1/epss?cve=CVE-2020-2306
epss 0.00064 https://api.first.org/data/v1/epss?cve=CVE-2020-2306
epss 0.00064 https://api.first.org/data/v1/epss?cve=CVE-2020-2306
epss 0.00064 https://api.first.org/data/v1/epss?cve=CVE-2020-2306
epss 0.00064 https://api.first.org/data/v1/epss?cve=CVE-2020-2306
epss 0.00064 https://api.first.org/data/v1/epss?cve=CVE-2020-2306
epss 0.00064 https://api.first.org/data/v1/epss?cve=CVE-2020-2306
epss 0.00064 https://api.first.org/data/v1/epss?cve=CVE-2020-2306
epss 0.00064 https://api.first.org/data/v1/epss?cve=CVE-2020-2306
epss 0.00064 https://api.first.org/data/v1/epss?cve=CVE-2020-2306
epss 0.00064 https://api.first.org/data/v1/epss?cve=CVE-2020-2306
epss 0.00064 https://api.first.org/data/v1/epss?cve=CVE-2020-2306
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-vrrc-3wwh-frgx
cvssv3.1 4.3 https://github.com/CVEProject/cvelist/blob/381fe967666a5ce01625a7a050427aa4757e3ca6/2020/2xxx/CVE-2020-2306.json
generic_textual MODERATE https://github.com/CVEProject/cvelist/blob/381fe967666a5ce01625a7a050427aa4757e3ca6/2020/2xxx/CVE-2020-2306.json
cvssv3.1 4.3 https://github.com/jenkinsci/mercurial-plugin/commit/edd59db1eec7e3c8d467372cd8417ae65eeb29dd
generic_textual MODERATE https://github.com/jenkinsci/mercurial-plugin/commit/edd59db1eec7e3c8d467372cd8417ae65eeb29dd
cvssv3.1 4.3 https://nvd.nist.gov/vuln/detail/CVE-2020-2306
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2020-2306
cvssv3.1 4.3 https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2104
generic_textual MODERATE https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2104
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-2306.json
https://api.first.org/data/v1/epss?cve=CVE-2020-2306
https://github.com/CVEProject/cvelist/blob/381fe967666a5ce01625a7a050427aa4757e3ca6/2020/2xxx/CVE-2020-2306.json
https://github.com/jenkinsci/mercurial-plugin/commit/edd59db1eec7e3c8d467372cd8417ae65eeb29dd
https://nvd.nist.gov/vuln/detail/CVE-2020-2306
https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2104
1895941 https://bugzilla.redhat.com/show_bug.cgi?id=1895941
GHSA-vrrc-3wwh-frgx https://github.com/advisories/GHSA-vrrc-3wwh-frgx
RHSA-2021:0034 https://access.redhat.com/errata/RHSA-2021:0034
RHSA-2021:0038 https://access.redhat.com/errata/RHSA-2021:0038
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-2306.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/CVEProject/cvelist/blob/381fe967666a5ce01625a7a050427aa4757e3ca6/2020/2xxx/CVE-2020-2306.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/jenkinsci/mercurial-plugin/commit/edd59db1eec7e3c8d467372cd8417ae65eeb29dd
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2020-2306
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2104
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.19836
EPSS Score 0.00064
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:11:56.500209+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-vrrc-3wwh-frgx/GHSA-vrrc-3wwh-frgx.json 38.0.0