Not rated

CVE-2020-2285 A missing permission check in Jenkins Liquibase Runner Plugin 1.4.7 and earlier allows attackers with Overall/Read…

Description

A missing permission check in Jenkins Liquibase Runner Plugin 1.4.7 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

Affected products and versions

Product	Affected versions	Fixed in
Jenkins Liquibase Runner Plugin 1.4	earliest → 1.4.7	No fix stated

The 3 CVEs of Jenkins Liquibase Runner Plugin →

CVE-2020-2284 Jenkins Liquibase Runner Plugin 1.4.5 and earlier does not configure its XML parser to prevent XML external entity (XXE)… Not rated CVE-2020-2283 Jenkins Liquibase Runner Plugin 1.4.5 and earlier does not escape changeset contents, resulting in a stored cross-site… Not rated

Do you use Jenkins Liquibase Runner Plugin?

Track this CVE Watch Jenkins Liquibase Runner Plugin Check my SBOMs

www.cveye.io/en/cve/CVE-2020-2285

Timeline

Published September 23, 2020
Last modified August 4, 2024

References

www.jenkins.io www.jenkins.io
[oss-security] 20200923 Multiple vulnerabilities in Jenkins plugins www.openwall.com

Track this CVE

CVE-2020-2285 A missing permission check in Jenkins Liquibase Runner Plugin 1.4.7 and earlier allows attackers with Overall/Read…

Description

Affected products and versions

Other CVEs of Jenkins Liquibase Runner Plugin