TI-2018-15765 Aliases CVE-2018-1000112 GHSA-f9cx-789c-w2mr

An improper authorization vulnerability exists in Jenkins Mercurial Plugin version 2.2…

LOW 26CWE-863Published 2018-03-13 · Updated 2024-09-17

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Low · None · None
Fix status: Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863.

Summary

An improper authorization vulnerability exists in Jenkins Mercurial Plugin version 2.2 and earlier in MercurialStatus.java that allows an attacker with network access to obtain a list of nodes and users.

Why it matters now

EPSS 0.00962 61st percentileScored 2026-11-07

Fix Partial org.jenkins-ci.plugins:mercurial (Maven): 2.3Red Hat: 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	org.jenkins-ci.plugins:mercurial (Maven)	before 2.3	2.3	Patch available	GHSA-f9cx-789c-w2mr

— Vendor— Affected all versions Fixed in — No fix listed CNA
org.jenkins-ci.plugins:mercurial (Maven) Vendor— Affected before 2.3 Fixed in 2.3 Patch available GHSA-f9cx-789c-w2mr

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:jenkins:mercurial::::::jenkins::*	up to 2.2	Vulnerable	Jenkins

cpe:2.3:a:jenkins:mercurial:*:*:*:*:*:jenkins:*:* Versions up to 2.2 Vulnerable ·Jenkins

Remediation

Fix · GHSA-f9cx-789c-w2mr org.jenkins-ci.plugins:mercurial (Maven) Fixed in 2.3 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat OpenShift Enterprise 3	Affected	No fix yet

Timeline

2026-10-02 Threatist record created from CVE-2018-1000112
2026-10-03 Alias added: GHSA-f9cx-789c-w2mr

References

Advisory 2

Other 1

https://github.com/jenkinsci/mercurial-plugin/commit/54b4f82e80c89d51b12bc64258f6b59e98b0c16a

TI-2022-13004 Path traversal in Jenkins Mercurial Plugin CVSS 3.1HIGH 7.5
TI-2022-21205 Information disclosure in Jenkins Mercurial Plugin CVSS 3.1MEDIUM 5.3
TI-2020-02182 XML external entity injection in Jenkins Mercurial Plugin CVSS 3.1MEDIUM 6.5
TI-2020-02183 Missing authorization in Jenkins Mercurial Plugin CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences