CVE-2018-1000132
mercurial - security update
9.1
CRITICAL
CVSS 3.1
EPSS 0.60%
Description
Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in Unauthorized data access. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 4.5.1.
How to fix CVE-2018-1000132
To remediate CVE-2018-1000132, upgrade the affected package to a fixed version below.
- —upgrade to 4.5.2-r0 or later
- —upgrade to 4.5.2-1 or later
- —upgrade to 2.2.2-4+deb7u7 or later
- —upgrade to 4.5.1 or later
- —upgrade to 4.5.1 or later
Is CVE-2018-1000132 being exploited?
Low — EPSS is 0.6%, meaning exploitation activity has not been observed at scale.
Affected packages (5)
- from 0, < 4.5.2-r0
- from 0, < 4.5.2-1
- from 0, < 2.2.2-4+deb7u7
- from 0, < 4.5.1
- from 0, < 4.5.1
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
| osv | CVSS 3.1 | CRITICAL9.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |