Recently modified vulnerabilities for "mercurial" 2.11

Where

AND

Sort:

redhat/jenkinsA missing permission check in Jenkins Mercurial Plugin 2.11 and earlier allows attackers with Overal…

Risk 23

Severity

4.3

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

A missing permission check in Jenkins Mercurial Plugin 2.11 and earlier allows attackers with Overall/Read permission to obtain a list of names of configured Mercurial installations.

1 / 3

First published (updated )

CVE-2020-2306

redhat/jenkinsXEE

Risk 39

Severity

6.5

XEE

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

A flaw was found in the mercurial plugin in Jenkins. The XML changelog parser is not configured to prevent an XML external entity (XXE) attack allowing an attacker the ability to control an agent process to have Jenkins parse a crafted changelog file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery. The highest threat from this vulnerability is to data confidentiality.

1 / 4

Remedy

Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.

First published (updated )

CVE-2020-2305

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.