CVE-2018-1000146 json
Liquibase Runner Plugin allows users to load arbitrary Java code into controller JVM
published 8y ago modified 4mo ago also GHSA-3hvc-xwjp-xr8m , EUVD-2022-2192
- cvss
- 8.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.5%
- EPSS 1.5% chance of exploitation in 30 days, percentile 75%
- public exploits
- 0
- none known
Summary
An arbitrary code execution vulnerability exists in Liquibase Runner Plugin version 1.3.0 and older that allows an attacker with permission to configure jobs to load and execute arbitrary code on the Jenkins master JVM.
Patch / fix
- maven org.jenkins-ci.plugins:liquibase-runner 1.4.3
Is CVE-2018-1000146 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerExploit prediction
1.55% chance of exploitation in the next 30 days, higher than 75% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
| GitHub | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins:liquibase-runner | <1.4.3 |
1.4.3 |
References
-
github.com
/jenkinsci/liquibase-runner-plugin/commit/1817af0b5bb17e690d89c0a1623de8bd47f8c1a1
web
-
github.com
/jenkinsci/liquibase-runner-plugin/commit/382a1ea84910db28a88089306b24d1e80818f0a5
web
-
github.com
/jenkinsci/liquibase-runner-plugin/commit/7726ce4569a287e32fbda6f01ad2846ada909436
web
-
jenkins.io
/security/advisory/2018-03-26/#SECURITY-519
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2018-1000146
advisory
-
github.com
/jenkinsci/liquibase-runner-plugin
web
Sources
- CVE List CVE-2018-1000146
- GitHub Advisory GHSA-3hvc-xwjp-xr8m
- NVD CVE-2018-1000146
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.