CVE-2018-1000132
published 2018-03-14CVE-2018-1000132: Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in Unauthorized data access…
PriorityP353critical9.1CVSS 3.0
AVNACLPRNUINSUCHIHAN
EPSS
2.65%
83.9th percentile
Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in Unauthorized data access. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 4.5.1.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | mercurial | < mercurial 4.5.2-1 (bookworm) | mercurial 4.5.2-1 (bookworm) |
| mercurial | mercurial | < 4.5.1 | 4.5.1 |
| mercurial | mercurial | >= 0 < 4.5.2-1 | 4.5.2-1 |
| mercurial | mercurial | >= 0 < 4.5.2-1 | 4.5.2-1 |
| mercurial | mercurial | >= 0 < 4.5.2-1 | 4.5.2-1 |
| mercurial | mercurial | >= 0 < 4.5.2-1 | 4.5.2-1 |
| mercurial | mercurial | >= 0 < 4.5.1 | 4.5.1 |
CVSS provenance
nvdv3.09.1CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N
osv9.1CRITICAL
vendor_debian9.1CRITICAL
vendor_redhat9.1CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Mercurial Incorrect Access Control vulnerability
osv·2022-05-13
CVE-2018-1000132 [CRITICAL] Mercurial Incorrect Access Control vulnerability
Mercurial Incorrect Access Control vulnerability
Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in Unauthorized data access. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 4.5.1.
GHSA
Mercurial Incorrect Access Control vulnerability
ghsa·2022-05-13
CVE-2018-1000132 [CRITICAL] CWE-732 Mercurial Incorrect Access Control vulnerability
Mercurial Incorrect Access Control vulnerability
Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in Unauthorized data access. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 4.5.1.
OSV
CVE-2018-1000132: Mercurial version 4
osv·2018-03-14·CVSS 9.1
CVE-2018-1000132 [CRITICAL] CVE-2018-1000132: Mercurial version 4
Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in Unauthorized data access. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 4.5.1.
Red Hat
mercurial: HTTP server permissions bypass
vendor_redhat·2018-03-08·CVSS 9.1
CVE-2018-1000132 [CRITICAL] CWE-20 mercurial: HTTP server permissions bypass
mercurial: HTTP server permissions bypass
Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in Unauthorized data access. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 4.5.1.
Package: mercurial (Red Hat Enterprise Linux 6) - Will not fix
Package: mercurial (Red Hat Enterprise Linux 8) - Not affected
Debian
CVE-2018-1000132: mercurial - Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) ...
vendor_debian·2018·CVSS 9.1
CVE-2018-1000132 [CRITICAL] CVE-2018-1000132: mercurial - Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) ...
Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in Unauthorized data access. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 4.5.1.
Scope: local
bookworm: resolved (fixed in 4.5.2-1)
bullseye: resolved (fixed in 4.5.2-1)
forky: resolved (fixed in 4.5.2-1)
sid: resolved (fixed in 4.5.2-1)
trixie: resolved (fixed in 4.5.2-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2018-1000132 mercurial: HTTP server permissions bypass [fedora-all]
bugzilla·2018-03-08·CVSS 9.1
CVE-2018-1000132 [CRITICAL] CVE-2018-1000132 mercurial: HTTP server permissions bypass [fedora-all]
CVE-2018-1000132 mercurial: HTTP server permissions bypass [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fe
Bugzilla
CVE-2018-1000132 mercurial: HTTP server permissions bypass
bugzilla·2018-03-08·CVSS 9.1
CVE-2018-1000132 [CRITICAL] CVE-2018-1000132 mercurial: HTTP server permissions bypass
CVE-2018-1000132 mercurial: HTTP server permissions bypass
Quote from release notes:
All versions of Mercurial prior to 4.5.2 have vulnerabilities in the HTTP server that allow permissions bypass to:
Perform writes on repositories that should be read-only
Perform reads on repositories that shouldn't allow read access
The nature of the vulnerabilities is:
Wire protocol commands that didn't explicitly declare their permissions had no permissions checking done. The web.{allow-pull, allow-push, deny_read, etc} config options governing access control were never consulted when running these commands. This allowed permissions bypass for impacted commands.
The batch wire protocol command did not list its permission requirements nor did it enforce permissions on individual sub-commands.
The
https://access.redhat.com/errata/RHSA-2019:2276https://lists.debian.org/debian-lts-announce/2018/03/msg00034.htmlhttps://lists.debian.org/debian-lts-announce/2018/07/msg00005.htmlhttps://lists.debian.org/debian-lts-announce/2020/07/msg00032.htmlhttps://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.5.1_.2F_4.5.2_.282018-03-06.29https://access.redhat.com/errata/RHSA-2019:2276https://lists.debian.org/debian-lts-announce/2018/03/msg00034.htmlhttps://lists.debian.org/debian-lts-announce/2018/07/msg00005.htmlhttps://lists.debian.org/debian-lts-announce/2020/07/msg00032.htmlhttps://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.5.1_.2F_4.5.2_.282018-03-06.29
2018-03-14
Published