CVE-2022-43410: Open Source Vulnerability in Jenkins Mercurial Plugin
Summary
CVE-2022-43410: Webhook endpoint discloses job names to unauthorized users in Jenkins Mercurial Plugin. Affects org.jenkins-ci.plugins:mercurial versions < 1260.vdfb_723cdcc81. Fixed in 1260.vdfb_723cdcc81. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Mercurial Plugin is a Maven package that provides integration between Jenkins and the Mercurial version control system. It allows Jenkins to monitor changes to Mercurial repositories and trigger builds or schedule polling for jobs configured with those repositories.
Vulnerability Detail
The Mercurial Plugin in versions 1251.va_b_121f184902 and earlier exposes a webhook endpoint at /mercurial/notifyCommit that can be accessed with GET requests and without authentication. This endpoint receives a repository URL and triggers polling for all jobs associated with the specified repository. However, the output of this endpoint includes information about triggered or scheduled jobs, even for jobs that the user does not have permission to access. This allows attackers with knowledge of Mercurial repository URLs to obtain information about the existence of jobs configured with this Mercurial repository. The vulnerability has a CVSS score of 5.3 (Medium).
How To Fix
Minimum fixed version
1260.vdfb_723cdcc81
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. Upgrading to the fixed version is the recommended solution.
Conclusion
The Jenkins Mercurial Plugin in versions prior to 1260.vdfb_723cdcc81 is vulnerable to unauthorized disclosure of job names through the webhook endpoint. Upgrading to the fixed version or applying the recommended fix is crucial to mitigate the risk associated with this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:mercurial →
FAQ
This vulnerability allows unauthorized users to obtain information about the existence of jobs configured with a specific Mercurial repository in Jenkins. It can potentially expose sensitive information about the Jenkins configuration and job structure.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins instance is affected by this vulnerability. Simply enter your Jenkins project's pom.xml file and Vulert will analyze it for any open-source vulnerabilities, including this one.
There are currently no known exploits for this vulnerability. However, it is important to apply the recommended fix or upgrade to the latest version of the Mercurial Plugin to mitigate the risk.
Yes, this vulnerability can be exploited remotely by sending a GET request to the vulnerable webhook endpoint without authentication.
There is no evidence of active attacks exploiting this vulnerability at the moment. However, it is advisable to apply the necessary fix or upgrade to prevent potential exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:mercurial.
