What is GHSA-xx7g-f287-f9fq?

GHSA-xx7g-f287-f9fq is a security advisory published by GitHub Security Advisories with High severity. XXE vulnerability in Jenkins Liquibase Runner Plugin

Which CVE IDs does GHSA-xx7g-f287-f9fq cover?

GHSA-xx7g-f287-f9fq covers the following CVE IDs: CVE-2020-2284. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-xx7g-f287-f9fq?

GHSA-xx7g-f287-f9fq has a CVSS v3 base score of 7.1, published by GitHub Security Advisories.

Which products are affected by GHSA-xx7g-f287-f9fq?

GHSA-xx7g-f287-f9fq affects 1 product, including: maven/org.jenkins-ci.plugins:liquibase-runner:\u003c= 1.4.5.

GHSA-xx7g-f287-f9fqHighCVSS 7.1

XXE vulnerability in Jenkins Liquibase Runner Plugin

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

October 27, 2023

🔗 CVE IDs covered (1)

CVE-2020-2284 →

📋 Description

Jenkins Liquibase Runner Plugin 1.4.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers able to provide Liquibase changesets evaluated by the plugin to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Jenkins Liquibase Runner Plugin 1.4.7 no longer parses Liquibase changesets.

🎯 Affected products1

maven/org.jenkins-ci.plugins:liquibase-runner:<= 1.4.5

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2020-2284
https://www.jenkins.io/security/advisory/2020-09-23/#SECURITY-1887
http://www.openwall.com/lists/oss-security/2020/09/23/1
https://github.com/advisories/GHSA-xx7g-f287-f9fq