Sign in

Not rated

CVE-2020-2284 Jenkins Liquibase Runner Plugin 1.4.5 and earlier does not configure its XML parser to prevent XML external entity (XXE)…

Description

Jenkins Liquibase Runner Plugin 1.4.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Affected products and versions

Product	Affected versions	Fixed in
Jenkins Liquibase Runner Plugin 1.4	earliest → 1.4.5	No fix stated

The 3 CVEs of Jenkins Liquibase Runner Plugin →

CVE-2020-2285 A missing permission check in Jenkins Liquibase Runner Plugin 1.4.7 and earlier allows attackers with Overall/Read… Not rated CVE-2020-2283 Jenkins Liquibase Runner Plugin 1.4.5 and earlier does not escape changeset contents, resulting in a stored cross-site… Not rated

Do you use Jenkins Liquibase Runner Plugin?

Track this CVE Watch Jenkins Liquibase Runner Plugin Check my SBOMs

www.cveye.io/en/cve/CVE-2020-2284

Timeline

Published September 23, 2020
Last modified August 4, 2024

References

www.jenkins.io www.jenkins.io
[oss-security] 20200923 Multiple vulnerabilities in Jenkins plugins www.openwall.com

Track this CVE