QwikSec

Security Database

CVE

CWE

Training

CVE-2021-43578

Published: Nov 12, 2021

Modified: Aug 4, 2024

PUBLISHED

Description

Jenkins Squash TM Publisher (Squash4Jenkins) Plugin 1.0.0 and earlier implements an agent-to-controller message that does not implement any validation of its input, allowing attackers able to control agent processes to replace arbitrary files on the Jenkins controller file system with an attacker-controlled JSON string.

Vendor	Product	Versions
Jenkins project	Jenkins Squash TM Publisher (Squash4Jenkins) Plugin	affected `unspecified - <= 1.0.0` unknown `next of 1.0.0 - < unspecified`

References

https://www.jenkins.io/security/advisory/2021-11-12/#SECURITY-2525

x_refsource_CONFIRM

[oss-security] 20211112 Multiple vulnerabilities in Jenkins plugins

mailing-list

x_refsource_MLIST

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.