CVSS 3.1
8.1 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HCVE-2021-43578
High (8.1) in jenkins squash tm publisher. EPSS 1.1% chance of exploitation in the next 30 days.
Jenkins Squash TM Publisher (Squash4Jenkins) Plugin 1.0.0 and earlier implements an agent-to-controller message that does not implement any validation of its input, allowing attackers able to control agent processes to replace arbitrary files on the Jenkins controller file system with an attacker-controlled JSON string.
Severity
- EPSS
- 1.1% chance of exploitation in the next 30 days; higher than 65% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- jenkins:squash_tm_publisher
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-h648-gj34-5x4r | Maven | org.jenkins-ci.plugins:squashtm-publisher-plugin | <=1.0.0 | no fix published |