Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in Unauthorized data access. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 4.5.1.
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade mercurial | Jul 31, 2018 | Mar 14, 2018 |
| Centos_linux | — | Upgrade mercurial-hgkUpgrade emacs-mercurialUpgrade mercurialUpgrade mercurial-debuginfoUpgrade emacs-mercurial-el | Aug 28, 2019 | Mar 14, 2018 |
| Debian | — | Upgrade mercurial | Feb 19, 2019 | Mar 14, 2018 |
| Huawei Euleros 2_0_sp1 | — | Upgrade mercurial | May 29, 2018 | Mar 14, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade mercurial | May 3, 2018 | Mar 14, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade mercurial | Jul 3, 2018 | Mar 14, 2018 |
| Oracle Solaris | — | Upgrade developer/versioning/mercurial to version 4.7.1-11.4.7.0.1.3.0 on Solaris 11.4Upgrade developer/versioning/mercurial-27 to version 4.7.1-11.4.7.0.1.3.0 on Solaris 11.4 | Mar 20, 2019 | Mar 14, 2018 |
| Oracle_linux | — | Upgrade emacs-mercurialUpgrade mercurial-hgkUpgrade emacs-mercurial-elUpgrade mercurial | Jul 21, 2020 | Mar 8, 2018 |
| Redhat_linux | — | Upgrade emacs-mercurial-elUpgrade mercurialUpgrade mercurial-hgkNo solution existsUpgrade emacs-mercurialUpgrade mercurial-debuginfo | Aug 7, 2019 | Mar 14, 2018 |
| Suse | — | Upgrade mercurial | Apr 11, 2018 | Mar 14, 2018 |
| Ubuntu | — | Upgrade mercurial | Nov 19, 2024 | Mar 14, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 14, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub