CVE-2008-4297
Mercurial before 1.0.2 does not enforce the allowpull permission setting for a pull operation from hgweb, which allows remote attackers to read arbitrary files from a repository…
Published: 2008-09-27 · CVSS: Unscored
Mercurial before 1.0.2 does not enforce the allowpull permission setting for a pull operation from hgweb, which allows remote attackers to read arbitrary files from a repository via an "hg pull" request.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7