CVE-2018-1000132

Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in Unauthorized data access. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 4.5.1.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.1 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 49%
VendorProductVersion
mercurialmercurial
𝑥
< 4.5.1
debiandebian_linux
7.0
debiandebian_linux
8.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
mercurial
bullseye
5.6.1-4
fixed
bookworm
6.3.2-1
fixed
sid
6.8.2-1
fixed
trixie
6.8.2-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
mercurial
cosmic
not-affected
bionic
not-affected
artful
ignored
xenial
Fixed 3.7.3-1ubuntu1.1
released
trusty
Fixed 2.8.2-1ubuntu1.4
released
Common Weakness Enumeration
References
https://access.redhat.com/errata/RHSA-2019:2276
https://lists.debian.org/debian-lts-announce/2018/03/msg00034.html
https://lists.debian.org/debian-lts-announce/2018/07/msg00005.html
https://lists.debian.org/debian-lts-announce/2020/07/msg00032.html
https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.5.1_.2F_4.5.2_.282018-03-06.29
https://access.redhat.com/errata/RHSA-2019:2276
https://lists.debian.org/debian-lts-announce/2018/03/msg00034.html
https://lists.debian.org/debian-lts-announce/2018/07/msg00005.html
https://lists.debian.org/debian-lts-announce/2020/07/msg00032.html
https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.5.1_.2F_4.5.2_.282018-03-06.29