CVE-2020-2284 – Jenkins Liquibase Runner Plugin 1.4.5 and earlier does not configure its

Jenkins Liquibase Runner Plugin 1.4.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

 

Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2284

Reference (s):

• https://www.jenkins.io/security/advisory/2020-09-23/#SECURITY-1887
• URL: https://www.jenkins.io/security/advisory/2020-09-23/#SECURITY-1887
• MLIST:[oss-security] 20200923 Multiple vulnerabilities in Jenkins plugins
• URL: http://www.openwall.com/lists/oss-security/2020/09/23/1