CVEvulnerability
CVE-2018-1000132
9.1 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2018-03-14
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.1 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- CVSS 2.0 ([email protected])
- 6.4 MEDIUM — AV:N/AC:L/Au:N/C:P/I:P/A:N
- Weaknesses
- CWE-732
Description
Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in Unauthorized data access. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 4.5.1.
Affected configurations
• mercurial mercurial (< 4.5.1)
• debian debian linux 7.0
• debian debian linux 8.0
Related
Weakness · CWE (1)
- CWE-732 Incorrect Permission Assignment for Critical Resource weakness
References
- https://access.redhat.com/errata/RHSA-2019:2276 access.redhat.com
- https://lists.debian.org/debian-lts-announce/2018/03/msg00034.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/07/msg00005.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/07/msg00032.html lists.debian.org
- https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.5.1_.2F_4.5.2_.282018-03-06.29 Release Notes, Vendor Advisory
- https://access.redhat.com/errata/RHSA-2019:2276 access.redhat.com
- https://lists.debian.org/debian-lts-announce/2018/03/msg00034.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/07/msg00005.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/07/msg00032.html lists.debian.org
- https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.5.1_.2F_4.5.2_.282018-03-06.29 Release Notes, Vendor Advisory