GitHub Advisoryadvisory · PyPI

GHSA-4mr4-7vjv-9hm6 Mercurial Incorrect Access Control vulnerability

CRITICAL Published 2022-05-13 Modified 2024-09-24 Official page ↗
Aliases
CVE-2018-1000132
Ecosystem
PyPI
Packages
mercurial
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-732
Reviewed
2024-05-01

Affected packages

• PyPI mercurial: < 4.5.1 → fixed in 4.5.1

Description

Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in Unauthorized data access. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 4.5.1.

Related

Alias · CVE (1)

  • CVE-2018-1000132 Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in… vulnerability

Weakness · CWE (1)

  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References