CVE-2018-1000146

published 2018-04-05

CVE-2018-1000146: An arbitrary code execution vulnerability exists in Liquibase Runner Plugin version 1.3.0 and older that allows an attacker with permission to configure jobs…

high 8.8 CVSS 3.0

AV N AC L PR L UI N S U C H I H A H

An arbitrary code execution vulnerability exists in Liquibase Runner Plugin version 1.3.0 and older that allows an attacker with permission to configure jobs to load and execute arbitrary code on the Jenkins master JVM.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
jenkins	ansible_plugin	—	—
jenkins	builds_started_before_the_plugin	—	—
jenkins	copy_to_slave_plugin	—	—
jenkins	cucumber_living_documentation_plugin	—	—
jenkins	github_pull_request_builder_plugin	—	—
jenkins	liquibase_runner	<= 1.3.0	—
jenkins	liquibase_runner_plugin	—	—
jenkins	mailer_plugin	—	—
jenkins	p4_plugin	—	—
jenkins	perforce_plugin	—	—
jenkins	reverse_proxy_auth_plugin	—	—
jenkins	we_recommend_that_users_of_perforce_plugin	—	—