CVE-2020-2306: Medium severity mercurial vulnerability
A missing permission check in Jenkins Mercurial Plugin 2.11 and earlier allows attackers with Overall/Read permission to obtain a list of names of configured Mercurial installations.
Other sources
Mercurial Plugin 2.11 and earlier does not perform a permission check in an HTTP endpoint.
This allows attackers with Overall/Read permission to obtain a list of names of configured Mercurial installations.
— Red Hat
Mercurial Plugin prior to 2.12, 2.10.1, 2.9.1, and 2.8.1 does not perform a permission check in an HTTP endpoint.
This allows attackers with Overall/Read permission to obtain a list of names of configured Mercurial installations.
Mercurial Plugin 2.12, 2.10.1, 2.9.1, and 2.8.1 performs permission checks when listing configured Mercurial installations.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-2306?
CVE-2020-2306 has a medium severity level as it allows unauthorized access to configured Mercurial installations.
How do I fix CVE-2020-2306?
To fix CVE-2020-2306, upgrade the Jenkins Mercurial Plugin to version 2.12 or later.
What is affected by CVE-2020-2306?
CVE-2020-2306 affects Jenkins Mercurial Plugin versions 2.11 and earlier.
What type of attack does CVE-2020-2306 enable?
CVE-2020-2306 enables attackers with overall read permission to retrieve configuration details of Mercurial installations.
Is authentication required for exploiting CVE-2020-2306?
No, attackers can exploit CVE-2020-2306 without needing to authenticate, as the vulnerability exists in an HTTP endpoint.