← All CVEs

CVE-2017-9462

high · 8.8

In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name.

8.8
CVSS
21.7%
EPSS (exploit prob.)
98th
EPSS percentile
2017-06-06
Published

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-732

Affected products

VendorProductAffected versions
mercurialmercurial< 4.1.3
debiandebian_linux8.0
debiandebian_linux9.0
redhatenterprise_linux_desktop6.0
redhatenterprise_linux_desktop7.0
redhatenterprise_linux_server6.0
redhatenterprise_linux_server7.0
redhatenterprise_linux_server_aus7.3
redhatenterprise_linux_server_aus7.4
redhatenterprise_linux_server_aus7.6
redhatenterprise_linux_server_eus7.3
redhatenterprise_linux_server_eus7.4
redhatenterprise_linux_server_eus7.5
redhatenterprise_linux_server_eus7.6
redhatenterprise_linux_server_tus7.3
redhatenterprise_linux_server_tus7.6
redhatenterprise_linux_workstation6.0
redhatenterprise_linux_workstation7.0

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2017-9462