CVE-2018-1000146 Liquibase Runner Plugin allows users to load arbitrary Java code into controller JVM

What is CVE-2018-1000146?

CVE-2018-1000146 is a high-severity code injection vulnerability in n/a, published on 5 Apr 2018. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An arbitrary code execution vulnerability exists in Liquibase Runner Plugin version 1.3.0 and older that allows an attacker with permission to configure jobs to load and execute arbitrary code on the Jenkins master JVM.

Which versions are affected by CVE-2018-1000146?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:liquibase-runner. It affects 1 product.

Products include Jenkins Liquibase Runner.

How do I fix CVE-2018-1000146?

Upgrade org.jenkins-ci.plugins:liquibase-runner to 1.4.3 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2018-1000146 being exploited?

There is no known exploitation of CVE-2018-1000146 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2020-2284 XXE vulnerability in Jenkins Liquibase Runner Plugin High 7.1
• CVE-2020-2283 Stored XSS vulnerability in Jenkins Liquibase Runner Plugin Medium 5.4
• CVE-2020-2285 Missing permission check in Jenkins Liquibase Runner Plugin allows enumerating credentials IDs Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3hvc-xwjp-xr8m.