CVE-2020-2283 - Jenkins Liquibase Runner Plugin 1.4.5 and earlier does not escape changeset contents, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users able to control changeset files evaluated by the plugin

Back Back to CVE browser

MEDIUM

Jenkins Liquibase Runner Plugin 1.4.5 and earlier does not escape changeset contents, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users able to control changeset files evaluated by the plugin

Published Sep 23, 2020

5.4

MEDIUM

CVSS 3.1

EPSS 0.73%

Description

Jenkins Liquibase Runner Plugin 1.4.5 and earlier does not escape changeset contents, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users able to control changeset files evaluated by the plugin.

Affected products

Vendor Jenkins project Product Jenkins Liquibase Runner Plugin Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <=1.4.5

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Jenkins project

Jenkins Liquibase Runner Plugin

n/a

Version	Status	Constraints
unspecified	affected	<=1.4.5

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (5)

http://www.openwall.com/lists/oss-security/2020/09/23/1
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://github.com/advisories/GHSA-9hg7-xmf8-jxf9
Advisory
https://github.com/jenkinsci/liquibase-runner-plugin/commit/4873c19dc921653d994edd6caa9e161c6353c6ae
https://nvd.nist.gov/vuln/detail/CVE-2020-2283
https://www.jenkins.io/security/advisory/2020-09-23/#SECURITY-1885
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2020/09/23/1		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://github.com/advisories/GHSA-9hg7-xmf8-jxf9		Advisory
https://github.com/jenkinsci/liquibase-runner-plugin/commit/4873c19dc921653d994edd6caa9e161c6353c6ae
https://nvd.nist.gov/vuln/detail/CVE-2020-2283
https://www.jenkins.io/security/advisory/2020-09-23/#SECURITY-1885		x_refsource_CONFIRMVendor Advisory