Description
Jenkins Mercurial Plugin 1251.va_b_121f184902 and earlier provides information about which jobs were triggered or scheduled for polling through its webhook endpoint, including jobs the user has no permission to access.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins project | Jenkins Mercurial Plugin | unspecified – ≤ 1251.va_b_121f184902 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ocp Tools 4 | jenkins-2-plugins | 4.12.1675702407-1.el8 | RHSA-2023:1064 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.plugins:mercurial | < 1260.vdfb_723cdcc81 | 1260.vdfb_723cdcc81 | GHSA-j7pg-863g-22p6 |
Advisories 2
- RHSA-2023:1064 Red Hat Security Advisory: OpenShift Developer Tools and Services for OCP 4.12 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- WID-SEC-2022-1804 Jenkins Plugins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 14, 2024