CVE-2020-2283: Stored XSS vulnerability in Jenkins Liquibase Runner Plugin
Summary
CVE-2020-2283: Stored XSS vulnerability in Jenkins Liquibase Runner Plugin. Affects org.jenkins-ci.plugins:liquibase-runner versions < 1.4.6. Fixed in 1.4.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Liquibase Runner Plugin is a Maven-based plugin that allows users to run Liquibase changesets as part of their Jenkins build process. Liquibase is a database schema management tool that enables developers to track, version, and apply database changes. The plugin integrates Liquibase functionality into Jenkins, providing a convenient way to manage database changes alongside the build process.
Vulnerability Detail
The Liquibase Runner Plugin version 1.4.5 and earlier is vulnerable to a stored cross-site scripting (XSS) attack. The plugin fails to properly escape changeset contents when displaying them on the build page. This allows an attacker to inject malicious scripts into the changeset, which will be executed when viewed by other users. The vulnerability can be exploited by attackers who can provide Liquibase changesets to be evaluated by the plugin. The impact of this vulnerability is significant, as it allows an attacker to execute arbitrary code in the context of other users, potentially leading to unauthorized access, data theft, or other malicious activities. The vulnerability has been assigned a CVSS score of 8.0, indicating a high severity level.
How To Fix
Minimum fixed version
1.4.6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the latest version of the Liquibase Runner Plugin to mitigate the risk.
Conclusion
The Jenkins Liquibase Runner Plugin version 1.4.5 and earlier is vulnerable to a stored XSS attack. To protect your Jenkins installation and prevent potential unauthorized access or data theft, it is crucial to upgrade to the latest version of the plugin (1.4.7 or later). This update eliminates the vulnerability by removing support for evaluating changesets. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:liquibase-runner →
FAQ
The Liquibase Runner Plugin is a Jenkins plugin that allows users to run Liquibase changesets as part of their build process. It integrates Liquibase functionality into Jenkins, providing a convenient way to manage database changes alongside the build process.
A stored cross-site scripting (XSS) vulnerability is a type of security vulnerability that allows an attacker to inject malicious scripts into a website or application. In the case of the Liquibase Runner Plugin, the vulnerability allows an attacker to inject malicious scripts into the changeset, which will be executed when viewed by other users.
The impact of this vulnerability is significant. It allows an attacker to execute arbitrary code in the context of other users, potentially leading to unauthorized access, data theft, or other malicious activities.
To fix this vulnerability, it is recommended to upgrade to Liquibase Runner Plugin version 1.4.7 or later. The latest version of the plugin no longer supports evaluating changesets, eliminating the vulnerability.
There is no known workaround for this vulnerability. It is essential to update to the latest version of the Liquibase Runner Plugin to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:liquibase-runner.
