Unrated severityNVD Advisory· Published Sep 27, 2008· Updated Jun 16, 2026

CVE-2008-4297

Description

Mercurial before 1.0.2 does not enforce the allowpull permission setting for a pull operation from hgweb, which allows remote attackers to read arbitrary files from a repository via an "hg pull" request.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Mercurial/Mercurial2 versions
cpe:2.3:a:mercurial:mercurial:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:mercurial:mercurial:*:*:*:*:*:*:*:*range: <=1.0.1
- (no CPE)range: <1.0.2

Patches

Vulnerability mechanics

References

lists.opensuse.org/opensuse-security-announce/2008-10/msg00004.htmlnvd
marc.infonvd
secunia.com/advisories/32182nvd
wiki.rpath.com/wiki/Advisories:rPSA-2008-0276nvd
www.securityfocus.com/archive/1/496488/100/0/threadednvd
www.securityfocus.com/bid/31223nvd
www.selenic.com/mercurial/wiki/index.cgi/WhatsNewnvd
www.vupen.com/english/advisories/2008/2604nvd
exchange.xforce.ibmcloud.com/vulnerabilities/45229nvd
issues.rpath.com/browse/RPL-2753nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000