Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:maven/org.jenkins-ci.plugins/mercurial@1260.vdfb_723cdcc81
Typemaven
Namespaceorg.jenkins-ci.plugins
Namemercurial
Version1260.vdfb_723cdcc81
Qualifiers
Subpath
Is_vulnerablefalse
Next_non_vulnerable_versionnull
Latest_non_vulnerable_versionnull
Affected_by_vulnerabilities
Fixing_vulnerabilities
0
url VCID-1pzb-gkrf-m3hq
vulnerability_id VCID-1pzb-gkrf-m3hq
summary 
Webhook endpoint discloses job names to unauthorized users in Jenkins Mercurial Plugin
Mercurial Plugin provides a webhook endpoint at `/mercurial/notifyCommit` that can be used to notify Jenkins of changes to an SCM repository. This endpoint receives a repository URL, and Jenkins will schedule polling for all jobs configured with the specified repository. It can be accessed with GET requests and without authentication.

In Mercurial Plugin 1251.va_b_121f184902 and earlier, the output of the webhook endpoint will provide information about which jobs were triggered or scheduled for polling, including jobs the user has no permission to access. This allows attackers with knowledge of Mercurial repository URLs to obtain information about the existence of jobs configured with this Mercurial repository.

Mercurial Plugin 1260.vdfb_723cdcc81 does not provide the names of jobs for which polling is triggered unless the user has the appropriate Item/Read permission.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-43410.json
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-43410.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2022-43410
reference_id
reference_type
scores
0
value 0.00513
scoring_system epss
scoring_elements 0.66588
published_at 2026-04-29T12:55:00Z
1
value 0.00513
scoring_system epss
scoring_elements 0.66564
published_at 2026-04-18T12:55:00Z
2
value 0.00513
scoring_system epss
scoring_elements 0.66548
published_at 2026-04-21T12:55:00Z
3
value 0.00513
scoring_system epss
scoring_elements 0.66503
published_at 2026-04-04T12:55:00Z
4
value 0.00513
scoring_system epss
scoring_elements 0.66474
published_at 2026-04-07T12:55:00Z
5
value 0.00513
scoring_system epss
scoring_elements 0.66523
published_at 2026-04-08T12:55:00Z
6
value 0.00513
scoring_system epss
scoring_elements 0.66536
published_at 2026-04-09T12:55:00Z
7
value 0.00513
scoring_system epss
scoring_elements 0.66555
published_at 2026-04-11T12:55:00Z
8
value 0.00513
scoring_system epss
scoring_elements 0.66543
published_at 2026-04-12T12:55:00Z
9
value 0.00513
scoring_system epss
scoring_elements 0.66511
published_at 2026-04-13T12:55:00Z
10
value 0.00513
scoring_system epss
scoring_elements 0.66547
published_at 2026-04-16T12:55:00Z
11
value 0.00513
scoring_system epss
scoring_elements 0.66477
published_at 2026-04-02T12:55:00Z
12
value 0.00513
scoring_system epss
scoring_elements 0.66572
published_at 2026-04-24T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2022-43410
2
reference_url https://github.com/jenkinsci/mercurial-plugin
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/jenkinsci/mercurial-plugin
3
reference_url https://github.com/jenkinsci/mercurial-plugin/commit/dfb723cdcc815875cdf63abd32e314ced5e95ac9
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/jenkinsci/mercurial-plugin/commit/dfb723cdcc815875cdf63abd32e314ced5e95ac9
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2022-43410
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2022-43410
5
reference_url https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2831
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-05-08T19:21:54Z/
url https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2831
6
reference_url http://www.openwall.com/lists/oss-security/2022/10/19/3
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-05-08T19:21:54Z/
url http://www.openwall.com/lists/oss-security/2022/10/19/3
7
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2136369
reference_id 2136369
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2136369
8
reference_url https://github.com/advisories/GHSA-j7pg-863g-22p6
reference_id GHSA-j7pg-863g-22p6
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-j7pg-863g-22p6
9
reference_url https://access.redhat.com/errata/RHSA-2023:1064
reference_id RHSA-2023:1064
reference_type
scores
url https://access.redhat.com/errata/RHSA-2023:1064
fixed_packages
0
url pkg:maven/org.jenkins-ci.plugins/mercurial@1260.vdfb_723cdcc81
purl pkg:maven/org.jenkins-ci.plugins/mercurial@1260.vdfb_723cdcc81
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.plugins/mercurial@1260.vdfb_723cdcc81
aliases CVE-2022-43410, GHSA-j7pg-863g-22p6
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-1pzb-gkrf-m3hq
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.plugins/mercurial@1260.vdfb_723cdcc81