CVE-2022-43410

2022-10-1916:15:10

jenkins

web.nvd.nist.gov

187

cve-2022-43410

jenkins

mercurial plugin

information disclosure

webhook endpoint

security vulnerability

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

33.5%

JSON

Jenkins Mercurial Plugin 1251.va_b_121f184902 and earlier provides information about which jobs were triggered or scheduled for polling through its webhook endpoint, including jobs the user has no permission to access.

Affected configurations

Nvd

Node

jenkinsmercurialRange≤1251.va_b_121f184902jenkins

VendorProductVersionCPE
jenkinsmercurial*cpe:2.3:a:jenkins:mercurial:*:*:*:*:*:jenkins:*:*

Vendor	Product	Version	CPE
jenkins	mercurial	*	cpe:2.3:a:jenkins:mercurial::::::jenkins::*

CNA Affected

[
  {
    "product": "Jenkins Mercurial Plugin",
    "vendor": "Jenkins project",
    "versions": [
      {
        "lessThanOrEqual": "1251.va_b_121f184902",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]