PatchTheCVECVE-2022-43410: Jenkins Mercurial Plugin 1251.va_b_121f184902 and earlier provides information about which jobs were triggered
CVE-2022-43410 is a medium-severity flaw (CVSS 5.3) affecting mercurial. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Jenkins Mercurial Plugin 1251.va_b_121f184902 and earlier provides information about which jobs were triggered or scheduled for polling through its webhook endpoint, including jobs the user has no permission to access.
Why this priority
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.8% (top 43%) |
| CISA exploited list | No |
| Weakness | CWE-200 |
| Published | 2022-10-19 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2022-43410?
mercurial: upgrade to newer than 1251.va_b_121f184902. Exact commands for each OS are on this page.
Is CVE-2022-43410 being exploited?
CVE-2022-43410 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2022-43410 affect?
CVE-2022-43410 affects mercurial. Severity is medium (CVSS 5.3). Jenkins Mercurial Plugin 1251.va_b_121f184902 and earlier provides information about which jobs were triggered or scheduled for polling through its webhook endpoint, including jobs the user has no permission to access.
How urgent is CVE-2022-43410?
Priority 38/100. Remotely exploitable, no login, no user action
Software pages
Related CVEs
- CVE-2022-30948 HIGH 7.5 UPGRADE Jenkins Mercurial Plugin 2.16 and earlier allows attackers able to configure pipelines to check out some SCM r
- CVE-2020-2306 MEDIUM 4.3 UPGRADE A missing permission check in Jenkins Mercurial Plugin 2.11 and earlier allows attackers with Overall/Read per
- CVE-2020-2305 MEDIUM 6.5 UPGRADE Jenkins Mercurial Plugin 2.11 and earlier does not configure its XML parser to prevent XML external entity (XX
- CVE-2014-9390 CRITICAL 9.8 UPGRADE UPGRADE Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Wind