1. CVE-Search
  2. CVE-2020-2306
ID CVE-2020-2306
Summary A missing permission check in Jenkins Mercurial Plugin 2.11 and earlier allows attackers with Overall/Read permission to obtain a list of names of configured Mercurial installations.
References
Vulnerable Configurations
  • cpe:2.3:a:jenkins:mercurial:1.0:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.0:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.1:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.1:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.2:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.2:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.3:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.3:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.4:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.4:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.5:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.5:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.6:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.6:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.7:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.7:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.8:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.8:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.9:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.9:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.10:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.10:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.11:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.11:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.12:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.12:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.13:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.13:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.14:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.14:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.15:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.15:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.16:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.16:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.17:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.17:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.18:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.18:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.19:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.19:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.20:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.20:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.21:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.21:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.22:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.22:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.23:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.23:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.24:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.24:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.25:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.25:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.26:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.26:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.27:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.27:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.28:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.28:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.29:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.29:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.30:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.30:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.31:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.31:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.32:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.32:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.33:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.33:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.34:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.34:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.35:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.35:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.36:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.36:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.37:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.37:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.38:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.38:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.39:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.39:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.40:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.40:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.41:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.41:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.42:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.42:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.43:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.43:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.44:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.44:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.45:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.45:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.46:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.46:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.47:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.47:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.48:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.48:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.49:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.49:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.50:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.50:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.50.1:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.50.1:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.51:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.51:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.52:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.52:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.53:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.53:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.54:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.54:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.55:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.55:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.56:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.56:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.57:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.57:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.58:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.58:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.59:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.59:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.60:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.60:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:1.61:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:1.61:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:2.0:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:2.0:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:2.1:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:2.1:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:2.2:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:2.2:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:2.3:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:2.3:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:2.4:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:2.4:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:2.5:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:2.5:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:2.6:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:2.6:*:*:*:*:jenkins:*:*
  • cpe:2.3:a:jenkins:mercurial:2.11:*:*:*:*:jenkins:*:*
    cpe:2.3:a:jenkins:mercurial:2.11:*:*:*:*:jenkins:*:*
CVSS
Base: 4.0 (as of 25-10-2023 - 18:16)
Impact:
Exploitability:
Access
VectorComplexityAuthentication
NETWORK LOW SINGLE
Impact
ConfidentialityIntegrityAvailability
PARTIAL NONE NONE
cvss-vector via4 AV:N/AC:L/Au:S/C:P/I:N/A:N
redhat via4
rpms
  • cri-o-0:1.18.4-5.rhaos4.5.gitd655863.el7
  • cri-o-0:1.18.4-5.rhaos4.5.gitd655863.el8
  • cri-o-debuginfo-0:1.18.4-5.rhaos4.5.gitd655863.el7
  • cri-o-debuginfo-0:1.18.4-5.rhaos4.5.gitd655863.el8
  • cri-o-debugsource-0:1.18.4-5.rhaos4.5.gitd655863.el8
  • jenkins-2-plugins-0:4.5.1610108899-1.el7
  • machine-config-daemon-0:4.5.0-202101080743.p0.git.2585.5bf8919.el8
  • openshift-hyperkube-0:4.5.0-202012221738.p0.git.0.9c544e4.el7
  • openshift-hyperkube-0:4.5.0-202012221738.p0.git.0.9c544e4.el8
  • openshift-kuryr-cni-0:4.5.0-202012221738.p0.git.2004.e3caa5a.el8
  • openshift-kuryr-common-0:4.5.0-202012221738.p0.git.2004.e3caa5a.el8
  • openshift-kuryr-controller-0:4.5.0-202012221738.p0.git.2004.e3caa5a.el8
  • python2-urllib3-0:1.26.2-1.el7
  • python3-kuryr-kubernetes-0:4.5.0-202012221738.p0.git.2004.e3caa5a.el8
  • atomic-openshift-service-idler-0:4.6.0-202012171504.p0.git.15.f4535bc.el8
  • console-login-helper-messages-0:0.20.3-1.rhaos4.6.el8
  • console-login-helper-messages-issuegen-0:0.20.3-1.rhaos4.6.el8
  • console-login-helper-messages-profile-0:0.20.3-1.rhaos4.6.el8
  • cri-o-0:1.19.1-2.rhaos4.6.git2af9ecf.el8
  • cri-o-debuginfo-0:1.19.1-2.rhaos4.6.git2af9ecf.el8
  • cri-o-debugsource-0:1.19.1-2.rhaos4.6.git2af9ecf.el8
  • jenkins-2-plugins-0:4.6.1608634578-1.el7
  • jenkins-2-plugins-0:4.6.1609853716-1.el8
  • openshift-ansible-0:4.6.0-202012172338.p0.git.0.a15d08c.el7
  • openshift-ansible-test-0:4.6.0-202012172338.p0.git.0.a15d08c.el7
  • openshift-clients-0:4.6.0-202012172338.p0.git.3800.30af700.el7
  • openshift-clients-0:4.6.0-202012172338.p0.git.3800.30af700.el8
  • openshift-clients-redistributable-0:4.6.0-202012172338.p0.git.3800.30af700.el7
  • openshift-clients-redistributable-0:4.6.0-202012172338.p0.git.3800.30af700.el8
  • openshift-hyperkube-0:4.6.0-202012190744.p0.git.94235.c62c6f7.el7
  • openshift-hyperkube-0:4.6.0-202012190744.p0.git.94235.c62c6f7.el8
  • openshift-kuryr-cni-0:4.6.0-202012171504.p0.git.2216.1fecf92.el8
  • openshift-kuryr-common-0:4.6.0-202012171504.p0.git.2216.1fecf92.el8
  • openshift-kuryr-controller-0:4.6.0-202012171504.p0.git.2216.1fecf92.el8
  • python3-kuryr-kubernetes-0:4.6.0-202012171504.p0.git.2216.1fecf92.el8
refmap via4
confirm https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2104
mlist [oss-security] 20201104 Multiple vulnerabilities in Jenkins plugins
Last major update 25-10-2023 - 18:16
Published 04-11-2020 - 15:15
Last modified 25-10-2023 - 18:16
Back to Top