PT-2020-15512 · Jenkins · Jenkins Liquibase Runner Plugin+1

Daniel Beck · Published 2020-09-23 · Updated 2023-11-02 · CVE-2020-2283

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Liquibase Runner Plugin versions 1.4.5 and earlier

Description The issue results in a stored cross-site scripting (XSS) vulnerability. This occurs because the plugin does not escape changeset contents when showing them on the build page. Attackers who can provide Liquibase changesets evaluated by the plugin can exploit this vulnerability.

Recommendations For versions 1.4.5 and earlier, consider disabling the evaluation of changesets by the plugin until a fix is available. Restrict access to the build page to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-2283

GHSA-9HG7-XMF8-JXF9

Affected Products

Jenkins

Jenkins Liquibase Runner Plugin

References · 7

• https://jenkins.io/security/advisory/2020-09-23/#SECURITY-1885 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2283 · Security Note
• https://osv.dev/vulnerability/CVE-2020-2283 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9hg7-xmf8-jxf9 · Vendor Advisory
• https://github.com/jenkinsci/liquibase-runner-plugin · Note
• https://github.com/jenkinsci/liquibase-runner-plugin/commit/4873c19dc921653d994edd6caa9e161c6353c6ae · Note
• http://openwall.com/lists/oss-security/2020/09/23/1 · Note