Liquibase Runner Plugin allows users to load arbitrary Java code into controller JVM

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2018-1000146 · ADVISORY
• jenkinsci/liquibase-runner-plugin commit 1817af0 · WEB
• jenkinsci/liquibase-runner-plugin commit 382a1ea · WEB
• jenkinsci/liquibase-runner-plugin commit 7726ce4 · WEB
• jenkinsci/liquibase-runner-plugin · WEB
• jenkins.io/security/advisory/2018-03-26 · WEB

Lỗ hổng khác của org.jenkins-ci.plugins:liquibase-runner

• CVE-2020-2285TRUNG BÌNH 4.3A missing permission check in Jenkins Liquibase Runner Plugin 1.4.7 and earlier allows attackers with Overall/Read permission to enumerate c…
• CVE-2020-2284CAO 7.1Jenkins Liquibase Runner Plugin 1.4.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
• CVE-2020-2283TRUNG BÌNH 5.4Jenkins Liquibase Runner Plugin 1.4.5 and earlier does not escape changeset contents, resulting in a stored cross-site scripting (XSS) vulne…