CVE-2022-43410: Infoleak
An information leak was found in a Jenkins plugin. This issue could allow an unauthenticated remote attacker to issue GET requests. The greatest impact is to confidentiality.
Other sources
In Mercurial Plugin 1251.vab121f184902 and earlier, the output of the webhook endpoint will provide information about which jobs were triggered or scheduled for polling, including jobs the user has no permission to access. This allows attackers with knowledge of Mercurial repository URLs to obtain information about the existence of jobs configured with this Mercurial repository.
https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2831
— Red Hat
Jenkins Mercurial Plugin 1251.vab121f184902 and earlier provides information about which jobs were triggered or scheduled for polling through its webhook endpoint, including jobs the user has no permission to access.
Mercurial Plugin provides a webhook endpoint at /mercurial/notifyCommit that can be used to notify Jenkins of changes to an SCM repository. This endpoint receives a repository URL, and Jenkins will schedule polling for all jobs configured with the specified repository. It can be accessed with GET requests and without authentication.
In Mercurial Plugin 1251.vab121f184902 and earlier, the output of the webhook endpoint will provide information about which jobs were triggered or scheduled for polling, including jobs the user has no permission to access. This allows attackers with knowledge of Mercurial repository URLs to obtain information about the existence of jobs configured with this Mercurial repository.
Mercurial Plugin 1260.vdfb723cdcc81 does not provide the names of jobs for which polling is triggered unless the user has the appropriate Item/Read permission.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/jenkinsto a version that resolves this vulnerability.Fixed in 2-plugins-0:4.12.1675702407-1.el8 - Upgrade
Upgrade
maven/org.jenkins-ci.plugins:mercurialto a version that resolves this vulnerability.Fixed in 1260.vdfb_723cdcc81 - Upgrade
Upgrade
redhat/mercurialto a version that resolves this vulnerability.Fixed in 1260. - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.4-2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.0.3-2 - Upgrade
Upgrade
Jenkins Mercurial Pluginto a version that resolves this vulnerability.Fixed in 1260.vdfb_723cdcc81 - Compensating control
Because the vulnerable webhook endpoint at `/mercurial/notifyCommit` can be accessed with GET requests and without authentication in Jenkins Mercurial Plugin 1251.va_b_121f184902 and earlier, restrict network access to Jenkins (or specifically this endpoint) so unauthenticated users cannot reach it (e.g., via firewall/ACL/WAF rules allowing access only from trusted sources).
Event History
Frequently Asked Questions
What is the severity of CVE-2022-43410?
CVE-2022-43410 is a critical vulnerability that impacts confidentiality due to an information leak in a Jenkins plugin.
How do I fix CVE-2022-43410?
To fix CVE-2022-43410, upgrade the Mercurial Plugin to version 1260.vdfb or later.
What types of software are affected by CVE-2022-43410?
CVE-2022-43410 affects Jenkins with the Mercurial Plugin version 1251.va_b_121f184902 and earlier.
What are the potential risks associated with CVE-2022-43410?
The main risk of CVE-2022-43410 is that an unauthenticated remote attacker could gain confidential information through the webhook endpoint.
Is there a workaround for CVE-2022-43410?
Disabling the affected Mercurial Plugin can temporarily mitigate the risks associated with CVE-2022-43410 until a patch is applied.