Skip to content
OpenAdvisories
High · 7.1 CVE-2020-2284 EUVD-2022-5876GHSA-xx7g-f287-f9fq

XXE vulnerability in Jenkins Liquibase Runner Plugin

Published Sep 23, 2020 · Updated Aug 4, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Liquibase Runner Plugin Package: org.jenkins-ci.plugins:liquibase-runner Category: Web / CMS Ecosystem: Maven

Description

Jenkins Liquibase Runner Plugin 1.4.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Affected products

VendorProductAffectedFixed
Jenkins project Jenkins Liquibase Runner Plugin unspecified – ≤ 1.4.5 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jenkins-ci.plugins:liquibase-runner < 1.4.7 1.4.7 GHSA-xx7g-f287-f9fq

References