Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-2306

CVE-2020-2306: Missing Authorization in Jenkins Mercurial Plugin

4.3

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-2306
GHSA ID
GHSA-vrrc-3wwh-frgx
EPSS Score
0.20129%
CWE
CWE-862
Published
5/24/2022
Updated
12/14/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.jenkins-ci.plugins:mercurialmaven= 2.112.12
org.jenkins-ci.plugins:mercurialmaven= 2.102.10.1
org.jenkins-ci.plugins:mercurialmaven= 2.92.9.1
org.jenkins-ci.plugins:mercurialmaven< 2.8.12.8.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The commit edd59db shows the doFillInstallationItems method was modified to add permission checks. Prior versions lacked these checks, exposing the installation list enumeration endpoint. This matches the CVE description of missing authorization in an HTTP endpoint.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

M*r*uri*l Plu*in prior to *.**, *.**.*, *.*.*, *n* *.*.* *o*s not p*r*orm * p*rmission ****k in *n *TTP *n*point. T*is *llows *tt**k*rs wit* Ov*r*ll/R*** p*rmission to o*t*in * list o* n*m*s o* *on*i*ur** M*r*uri*l inst*ll*tions. M*r*uri*l Plu*in *

Reasoning

T** *ommit ******* s*ows t** *o*illInst*ll*tionIt*ms m*t*o* w*s mo*i*i** to *** p*rmission ****ks. Prior v*rsions l**k** t**s* ****ks, *xposin* t** inst*ll*tion list *num*r*tion *n*point. T*is m*t***s t** *V* **s*ription o* missin* *ut*oriz*tion in *