GHSA-9hg7-xmf8-jxf9

Stored XSS vulnerability in Jenkins Liquibase Runner Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-2283

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:liquibase-runner	< 1.4.6	1.4.6

Details

As written in the advisory (Markdown source, shown as plain text).

Liquibase Runner Plugin 1.4.5 and earlier does not escape changeset contents when showing them on the build page. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide Liquibase changesets evaluated by the plugin. Liquibase Runner Plugin 1.4.7 no longer supports evaluating changesets.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-2283 advisory
https://github.com/jenkinsci/liquibase-runner-plugin/commit/4873c19dc921653d994edd6caa9e161c6353c6ae web
https://github.com/jenkinsci/liquibase-runner-plugin package
https://www.jenkins.io/security/advisory/2020-09-23/#SECURITY-1885 web
http://www.openwall.com/lists/oss-security/2020/09/23/1 web