[org.jenkins-ci.plugins:mercurial] Jenkins Mercurial Plugin provides info about jobs triggered or scheduled for polling through webhook endpoint

Jenkins Mercurial Plugin 1251.va_b_121f184902 and earlier provides information about which jobs were triggered or scheduled for polling through its webhook endpoint, including jobs the user has no permission to access. Mercurial Plugin 1260.vdfb_723cdcc81 does not provide the names of jobs for which polling is triggered unless the user has the appropriate Item/Read permission.

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-43410
• https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2831
• http://www.openwall.com/lists/oss-security/2022/10/19/3
• https://github.com/advisories/GHSA-j7pg-863g-22p6