org.jenkins-ci.plugins:bitbucket-approval-filter (1.0.0), org.jenkins-ci.plugins:bitbucket-filter-project-trait (1.0) +3 more potentially affected by CVE-2018-1000112 via org.jenkins-ci.plugins:mercurial (>=2.0-alpha-1, <=2.1)

org.jenkins-ci.plugins:mercurial MAVEN version =2.0-alpha-1, =2.2.0-alpha-1, =1.1.3, =1.0.0, =1.0.2 Source cves: CVE-2018-1000112 Source advisory: OSV:GHSA-F9CX-789C-W2MR...

org.jenkins-ci.plugins:bitbucket (>=1.1.4, <=1.1.13), org.jenkins-ci.plugins:bitbucket-build-status-notifier (>=1.1.0, <=1.4.2) +2 more potentially affected by CVE-2018-1000112 via org.jenkins-ci.plugins:mercurial (1.54)

org.jenkins-ci.plugins:mercurial MAVEN version 1.54 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:mercurial and may be impacted: - org.jenkins-ci.plugins:bitbucket =1.1.4, =1.1.0, =1.3, =1.1.0, =1.1.2 Source cves:...

org.jenkins-ci.plugins.workflow:workflow-aggregator (0.1-beta-1), org.jenkins-ci.plugins.workflow:workflow-scm-step (0.1-beta-1) potentially affected by CVE-2018-1000112 via org.jenkins-ci.plugins:mercurial (1.51-beta-1)

org.jenkins-ci.plugins:mercurial MAVEN version 1.51-beta-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:mercurial and may be impacted: - org.jenkins-ci.plugins.workflow:workflow-aggregator 0.1-beta-1 -...

org.jenkins-ci.plugins:pretested-integration (1.1) potentially affected by CVE-2018-1000112 via org.jenkins-ci.plugins:mercurial (1.39)

org.jenkins-ci.plugins:mercurial MAVEN version 1.39 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:mercurial and may be impacted: - org.jenkins-ci.plugins:pretested-integration 1.1 Source cves: CVE-2018-1000112 Source advisory:...

org.jenkins-ci.plugins:bitbucket-approval-filter (1.0.0), org.jenkins-ci.plugins:bitbucket-filter-project-trait (1.0) +3 more potentially affected by CVE-2018-1000112 via org.jenkins-ci.plugins:mercurial (>=2.0-alpha-1, <=2.1)

org.jenkins-ci.plugins:mercurial MAVEN version =2.0-alpha-1, =2.2.0-alpha-1, =1.1.3, =1.0.0, =1.0.2 Source cves: CVE-2018-1000112 Source advisory: GHSA-F9CX-789C-W2MR...

CVE-2018-1000112

An improper authorization vulnerability exists in Jenkins Mercurial Plugin version 2.2 and earlier in MercurialStatus.java that allows an attacker with network access to obtain a list of nodes and users...

CVE-2018-1000112

Vulnerability: Jenkins Mercurial Plugin up to version 2.2 contains an improper authorization flaw in MercurialStatus.java that allows an attacker with network access to retrieve a list of nodes and users (information disclosure). Affected software: Jenkins Mercurial Plugin (versions 2.2 and earli...