CVE-2020-2284: XXE vulnerability in Jenkins Liquibase Runner Plugin
Summary
CVE-2020-2284: XXE vulnerability in Jenkins Liquibase Runner Plugin. Affects org.jenkins-ci.plugins:liquibase-runner versions < 1.4.7. Fixed in 1.4.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Liquibase Runner Plugin is a Maven package that allows users to run Liquibase changesets as part of their Jenkins pipeline. Liquibase is a database schema management tool that enables developers to track, version, and apply database changes. The plugin integrates Liquibase into Jenkins, providing a convenient way to manage database changes within the CI/CD pipeline.
Vulnerability Detail
The Liquibase Runner Plugin version 1.4.5 and earlier is vulnerable to an XML External Entity (XXE) attack. The plugin does not properly configure its XML parser, allowing attackers to exploit this vulnerability. By providing crafted Liquibase changesets, an attacker can trick Jenkins into parsing a malicious XML file that includes external entities. This can lead to the extraction of sensitive information from the Jenkins controller or enable server-side request forgery.
How To Fix
Latest published version: 1.4.10 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.7
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of the Liquibase Runner Plugin to ensure the security of the Jenkins environment.
Conclusion
The XXE vulnerability in Jenkins Liquibase Runner Plugin (CVE-2020-2284) poses a significant risk to Jenkins environments. It allows attackers to extract sensitive information or perform server-side request forgery. To mitigate this vulnerability, it is crucial to update to Liquibase Runner Plugin version 1.4.7 or later. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:liquibase-runner →
FAQ
An XML External Entity (XXE) vulnerability is a type of attack that exploits the way XML parsers process external entities. By including malicious external entities in XML input, an attacker can access files, execute remote requests, or extract sensitive information.
This vulnerability allows an attacker to extract sensitive information from the Jenkins controller or perform server-side request forgery. This can lead to unauthorized access, data leakage, or further exploitation of the Jenkins environment.
You can use Vulert's playground (https://vulert.com/scanner) to check if your Jenkins environment is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, providing valuable insights without requiring access to the code or installation.
Yes, the fix for this vulnerability is to upgrade to Liquibase Runner Plugin version 1.4.7 or later. This version no longer parses Liquibase changesets, eliminating the XXE vulnerability.
You can find more information about this vulnerability in the GitHub Advisory Database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-xx7g-f287-f9fq/GHSA-xx7g-f287-f9fq.json).
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:liquibase-runner.
