CVE-2021-43578

Published: Nov 12, 2021Modified: Jun 17, 2026

8.1

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Exploitability: 2.8 / Impact: 5.2

Source: NVD

Description

Jenkins Squash TM Publisher (Squash4Jenkins) Plugin 1.0.0 and earlier implements an agent-to-controller message that does not implement any validation of its input, allowing attackers able to control agent processes to replace arbitrary files on the Jenkins controller file system with an attacker-controlled JSON string.

Affected (1)

Products: Jenkins: Squash Tm Publisher

1 product

Squash Tm Publisher

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Jenkins Squash Tm Publisher	Up to 1.0.0

References (4)

http://www.openwall.com/lists/oss-security/2021/11/12/1

Source: jenkinsci-cert@googlegroups.com

Mailing ListThird Party Advisory

https://www.jenkins.io/security/advisory/2021-11-12/#SECURITY-2525

Source: jenkinsci-cert@googlegroups.com

Vendor Advisory

http://www.openwall.com/lists/oss-security/2021/11/12/1

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://www.jenkins.io/security/advisory/2021-11-12/#SECURITY-2525

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.