Missing authorization in Jenkins Mercurial Plugin
Priority LOW 22CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-862.
Summary
A missing permission check in Jenkins Mercurial Plugin 2.11 and earlier allows attackers with Overall/Read permission to obtain a list of names of configured Mercurial installations.
Why it matters now
EPSS 0.011 65th percentileScored 2026-11-07
Fix Fixed Jenkins Mercurial Plugin (Jenkins project): 2.10.1, 2.9.1, 2.8.1org.jenkins-ci.plugins:mercurial (Maven): 2.12, 2.10.1, 2.9.1 +1Red Hat: 3 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Jenkins | Jenkins Mercurial Plugin | up to 2.11 | 2.10.1, 2.9.1, 2.8.1 | Patch available | CNA |
| — | org.jenkins-ci.plugins:mercurial (Maven) | 2.11 to before 2.12 | 2.12 | Patch available | GHSA-vrrc-3wwh-frgx |
| — | org.jenkins-ci.plugins:mercurial (Maven) | 2.10 to before 2.10.1 | 2.10.1 | Patch available | GHSA-vrrc-3wwh-frgx |
| — | org.jenkins-ci.plugins:mercurial (Maven) | 2.9 to before 2.9.1 | 2.9.1 | Patch available | GHSA-vrrc-3wwh-frgx |
| — | org.jenkins-ci.plugins:mercurial (Maven) | before 2.8.1 | 2.8.1 | Patch available | GHSA-vrrc-3wwh-frgx |
- Jenkins Mercurial Plugin VendorJenkins Affected up to 2.11 Fixed in 2.10.1, 2.9.1, 2.8.1 Patch available CNA
- org.jenkins-ci.plugins:mercurial (Maven) Vendor— Affected 2.11 to before 2.12 Fixed in 2.12 Patch available GHSA-vrrc-3wwh-frgx
- org.jenkins-ci.plugins:mercurial (Maven) Vendor— Affected 2.10 to before 2.10.1 Fixed in 2.10.1 Patch available GHSA-vrrc-3wwh-frgx
- org.jenkins-ci.plugins:mercurial (Maven) Vendor— Affected 2.9 to before 2.9.1 Fixed in 2.9.1 Patch available GHSA-vrrc-3wwh-frgx
- org.jenkins-ci.plugins:mercurial (Maven) Vendor— Affected before 2.8.1 Fixed in 2.8.1 Patch available GHSA-vrrc-3wwh-frgx
Remediation
- Fix · CNA Jenkins Mercurial Plugin (Jenkins project) Fixed in 2.10.1, 2.9.1, 2.8.1
- Fix · GHSA-vrrc-3wwh-frgx org.jenkins-ci.plugins:mercurial (Maven) Fixed in 2.12 Advisory →
- Fix · GHSA-vrrc-3wwh-frgx org.jenkins-ci.plugins:mercurial (Maven) Fixed in 2.10.1 Advisory →
- Fix · GHSA-vrrc-3wwh-frgx org.jenkins-ci.plugins:mercurial (Maven) Fixed in 2.9.1 Advisory →
- Fix · GHSA-vrrc-3wwh-frgx org.jenkins-ci.plugins:mercurial (Maven) Fixed in 2.8.1 Advisory →
Red Hat 3 advisories
- RHSA-2021:0637 Released 2021-03-03 · Red Hat rating ImportantOpenShift Container Platform 3.11.394 bug fix and security update
- Red Hat OpenShift Container Platform 3.11 jenkins-2-plugins-3.11.1612862361-1.el7, jenkins-2.263.3.1612433584-1.el7, python-rsa-4.5-3.el7 +1
- RHSA-2021:0034 Released 2021-01-20 · Red Hat rating ImportantOpenShift Container Platform 4.5.27 packages and security update
- Red Hat OpenShift Container Platform 4.5 jenkins-2-plugins-4.5.1610108899-1.el7, python-urllib3-1.26.2-1.el7, python2-urllib3-1.26.2-1.el7
- RHSA-2021:0038 Released 2021-01-18 · Red Hat rating ImportantOpenShift Container Platform 4.6.12 packages and security update
- Red Hat OpenShift Container Platform 4.6 cri-o-1.19.1-2.rhaos4.6.git2af9ecf.el8, jenkins-2-plugins-4.6.1608634578-1.el7, jenkins-2-plugins-4.6.1609853716-1.el8 +8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Container Platform 3.11 | Fixed | RHSA-2021:0637 |
| Red Hat OpenShift Container Platform 4.5 | Fixed | RHSA-2021:0034 |
| Red Hat OpenShift Container Platform 4.6 | Fixed | RHSA-2021:0038 |
Not affected: 3 products
- Red Hat OpenShift Container Platform 3.11
- Red Hat OpenShift Container Platform 4.5
- Red Hat OpenShift Container Platform 4.6
Timeline
- 2026-10-02 Threatist record created from CVE-2020-2306
- 2026-10-03 Alias added: GHSA-vrrc-3wwh-frgx
References
Advisory 2
More Jenkins Mercurial vulnerabilities
- TI-2022-13004 Path traversal in Jenkins Mercurial Plugin CVSS 3.1HIGH 7.5
- TI-2022-21205 Information disclosure in Jenkins Mercurial Plugin CVSS 3.1MEDIUM 5.3
- TI-2020-02182 XML external entity injection in Jenkins Mercurial Plugin CVSS 3.1MEDIUM 6.5
- TI-2018-15765 An improper authorization vulnerability exists in Jenkins Mercurial Plugin version 2.2… CVSS 3.0MEDIUM 5.3
Sources
- CVE-2020-2306 · CVE Program
- CVE-2020-2306 · NVD
- FIRST EPSS
- GHSA-vrrc-3wwh-frgx · GitHub Advisory Database · CC BY 4.0
- CVE-2020-2306 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences