CVE-2008-4297

Mercurial before 1.0.2 does not enforce the allowpull permission setting for a pull operation from hgweb, which allows remote attackers to read arbitrary files…

published September 27, 2008

CVSS
—
EPSS
3%
Percentile
85.7
In the wild
Unconfirmed
What it is

Mercurial before 1.0.2 does not enforce the allowpull permission setting for a pull operation from hgweb, which allows remote attackers to read arbitrary files from a repository via an "hg pull" request.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02695 · 85.7th percentile
Published
2008-09-27T00:00Z
EPSS history
Timeline
  • 27 SEP 00:00Z
    Mercurial before 1.0.2 does not enforce the allowpull permission setting for a pull operation from hgweb, which allows remote attackers to read arbitrary files…
    cvelistv5