Loading HuntDB...
Hunt
Vulnerability Intelligence by wss.sh
Home Daily Briefings High Impact CVEs Recent Exploits KEV Catalog GitHub Advisories Latest Updates Security News
Sign In Sign Up

GHSA-9hg7-xmf8-jxf9

GitHub Security Advisory

Stored XSS vulnerability in Jenkins Liquibase Runner Plugin

✓ GitHub Reviewed MODERATE Has CVE
View on GitHub

Advisory Details

Liquibase Runner Plugin 1.4.5 and earlier does not escape changeset contents when showing them on the build page.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide Liquibase changesets evaluated by the plugin.

Liquibase Runner Plugin 1.4.7 no longer supports evaluating changesets.

Affected Packages

Maven org.jenkins-ci.plugins:liquibase-runner
Affected versions: 0 (fixed in 1.4.6)

Related CVEs

CVE-2020-2283

Key Information

GHSA ID
GHSA-9hg7-xmf8-jxf9
Published
May 24, 2022 5:29 PM
Last Modified
October 27, 2023 11:31 AM
CVSS Score
5.0 /10
Primary Ecosystem
Maven
Primary Package
org.jenkins-ci.plugins:liquibase-runner
GitHub Reviewed
✓ Yes

Dataset

Last updated: August 24, 2025 6:28 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.