Description

An arbitrary code execution vulnerability exists in Liquibase Runner Plugin version 1.3.0 and older that allows an attacker with permission to configure jobs to load and execute arbitrary code on the Jenkins master JVM.

Remediation

References

https://jenkins.io/security/advisory/2018-03-26/#SECURITY-519

Related Vulnerabilities

CVE-2018-8319 Vulnerability in npm package msrcrypto

CVE-2014-3488 Vulnerability in maven package io.netty:netty

CVE-2019-10403 Vulnerability in maven package org.jenkins-ci.main:jenkins-core

CVE-2022-40705 Vulnerability in maven package soap:soap

CVE-2023-32314 Vulnerability in npm package vm2

Severity

Critical

Classification

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Vendor Advisory NVD-CWE-noinfo