CVE-2020-2285: 
Java vulnerability analysis and mitigation

A missing permission check vulnerability (CVE-2020-2285) was discovered in Jenkins Liquibase Runner Plugin versions 1.4.7 and earlier. The vulnerability was disclosed on September 23, 2020, affecting the plugin's HTTP endpoint functionality (Jenkins Advisory, OSS Security).

The vulnerability stems from a missing permission check in an HTTP endpoint of the Liquibase Runner Plugin. The issue has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, indicating a network-exploitable vulnerability with low attack complexity and requiring low privileges (NVD).

The vulnerability allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. These enumerated credentials IDs could potentially be used as part of a broader attack to capture the actual credentials if combined with another vulnerability (Jenkins Advisory).

The vulnerability requires an attacker to have Overall/Read permission in the Jenkins instance to exploit. No public exploits have been reported in the wild at the time of the advisory (Jenkins Advisory).

The vulnerability has been fixed in Liquibase Runner Plugin version 1.4.8, which implements appropriate permission checks for credentials ID enumeration. Users are advised to upgrade to this version or later to address the security issue (Jenkins Advisory).