PT-2020-15536 · Jenkins · Jenkins Mercurial Plugin+1

Published 2020-11-04 · Updated 2023-10-25 · CVE-2020-2306

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Mercurial Plugin versions 2.11 and earlier Jenkins Mercurial Plugin versions prior to 2.12

Description A missing permission check in the Jenkins Mercurial Plugin allows attackers with Overall/Read permission to obtain a list of names of configured Mercurial installations. This issue is related to an HTTP endpoint that does not perform a permission check, enabling attackers to access sensitive information.

Recommendations For Jenkins Mercurial Plugin versions 2.11 and earlier, update to version 2.12 or later to resolve the issue. For Jenkins Mercurial Plugin versions prior to 2.12, update to version 2.12 or later to resolve the issue. As a temporary workaround, consider restricting access to the HTTP endpoint related to Mercurial installations to minimize the risk of exploitation.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2020-2306

GHSA-VRRC-3WWH-FRGX

RHSA-2021:0034

RHSA-2021:0038

RHSA-2021:0637

Affected Products

Jenkins

Jenkins Mercurial Plugin

References · 7

• 🔥 https://github.com/CVEProject/cvelist/blob/381fe967666a5ce01625a7a050427aa4757e3ca6/2020/2xxx/CVE-2020-2306.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-2306 · Security Note
• https://osv.dev/vulnerability/CVE-2020-2306 · Vendor Advisory
• https://jenkins.io/security/advisory/2020-11-04/#SECURITY-2104 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vrrc-3wwh-frgx · Vendor Advisory
• https://github.com/jenkinsci/mercurial-plugin/commit/edd59db1eec7e3c8d467372cd8417ae65eeb29dd · Note
• https://t.me/cvenotify/5144 · Telegram Post