| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.plugins:liquibase-runner | < 1.4.6 | 1.4.6 |
| liquibase runner | ≤ 1.4.5 |
Liquibase Runner Plugin 1.4.5 and earlier does not escape changeset contents when showing them on the build page.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide Liquibase changesets evaluated by the plugin.
Liquibase Runner Plugin 1.4.7 no longer supports evaluating changesets.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free