CVE-2018-1000146

published 2018-04-05

CVE-2018-1000146: An arbitrary code execution vulnerability exists in Liquibase Runner Plugin version 1.3.0 and older that allows an attacker with permission to configure jobs…

Priority P3 52 high 8.8 CVSS 3.0

AV N AC L PR L UI N S U C H I H A H

An arbitrary code execution vulnerability exists in Liquibase Runner Plugin version 1.3.0 and older that allows an attacker with permission to configure jobs to load and execute arbitrary code on the Jenkins master JVM.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
jenkins	ansible_plugin	—	—
jenkins	builds_started_before_the_plugin	—	—
jenkins	copy_to_slave_plugin	—	—
jenkins	cucumber_living_documentation_plugin	—	—
jenkins	github_pull_request_builder_plugin	—	—
jenkins	liquibase_runner	<= 1.3.0	—
jenkins	liquibase_runner_plugin	—	—
jenkins	mailer_plugin	—	—
jenkins	p4_plugin	—	—
jenkins	perforce_plugin	—	—
jenkins	reverse_proxy_auth_plugin	—	—
jenkins	we_recommend_that_users_of_perforce_plugin	—	—

CVSS provenance

nvd v3.0 8.8 HIGH CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.