| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.plugins:mercurial | ≥ 2.10, < 2.10.1≥ 2.11, < 2.12≥ 2.9, < 2.9.1< 2.8.1 | 2.10.12.122.9.12.8.1 |
| mercurial | ≤ 2.11 |
Mercurial Plugin prior to 2.12, 2.10.1, 2.9.1, and 2.8.1 does not perform a permission check in an HTTP endpoint.
This allows attackers with Overall/Read permission to obtain a list of names of configured Mercurial installations.
Mercurial Plugin 2.12, 2.10.1, 2.9.1, and 2.8.1 performs permission checks when listing configured Mercurial installations.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free