1. CVE-Search
  2. CVE-2018-1000112
ID CVE-2018-1000112
Summary An improper authorization vulnerability exists in Jenkins Mercurial Plugin version 2.2 and earlier in MercurialStatus.java that allows an attacker with network access to obtain a list of nodes and users.
References
Vulnerable Configurations
  • cpe:2.3:a:jenkins:mercurial:1.0:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.0:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.1:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.1:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.2:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.2:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.3:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.3:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.4:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.4:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.5:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.5:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.6:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.6:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.7:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.7:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.8:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.8:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.9:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.9:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.10:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.10:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.11:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.11:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.12:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.12:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.13:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.13:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.14:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.14:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.15:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.15:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.16:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.16:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.17:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.17:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.18:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.18:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.19:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.19:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.20:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.20:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.21:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.21:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.22:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.22:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.23:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.23:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.24:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.24:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.25:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.25:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.26:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.26:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.27:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.27:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.28:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.28:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.29:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.29:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.30:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.30:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.31:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.31:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.32:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.32:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.33:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.33:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.34:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.34:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.35:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.35:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.36:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.36:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.37:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.37:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.38:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.38:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.39:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.39:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.40:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.40:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.41:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.41:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.42:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.42:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.43:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.43:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.44:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.44:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.45:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.45:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.46:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.46:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.47:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.47:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.48:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.48:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.49:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.49:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.50:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.50:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.50.1:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.50.1:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.51:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.51:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.52:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.52:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.53:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.53:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.54:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.54:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.55:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.55:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.56:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.56:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.57:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.57:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.58:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.58:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.59:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.59:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.60:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.60:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.61:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.61:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:2.0:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:2.0:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:2.1:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:2.1:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:2.2:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:2.2:*:*:*:*:jenkins:*:*
CVSS
Base: 5.0 (as of 03-10-2019 - 00:03)
Impact:
Exploitability:
CWE CWE-863
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL NONE NONE
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:N/A:N
refmap via4
confirm https://jenkins.io/security/advisory/2018-02-26/#SECURITY-726
Last major update 03-10-2019 - 00:03
Published 13-03-2018 - 13:29
Last modified 03-10-2019 - 00:03
Back to Top