CVE-2021-43578

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Jenkins Squash TM Publisher (Squash4Jenkins) Plugin 1.0.0 and earlier implements an agent-to-controller message that does not implement any validation of its input, allowing attackers able to control agent processes to replace arbitrary files on the Jenkins controller file system with an attacker-controlled JSON string.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins Squash TM Publisher (Squash4Jenkins) Plugin	>= unspecified, <= 1.0.0

References

http://www.openwall.com/lists/oss-security/2021/11/12/1Mailing List, Third Party Advisory
https://www.jenkins.io/security/advisory/2021-11-12/#SECURITY-2525Vendor Advisory
http://www.openwall.com/lists/oss-security/2021/11/12/1Mailing List, Third Party Advisory
https://www.jenkins.io/security/advisory/2021-11-12/#SECURITY-2525Vendor Advisory

Timeline

Published: Nov 12, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-435797.8A stack-based buffer overflow in image_load_bmp() in HTMLDOC <= 1.9.13 results in remote code execution if the victim converts an HTML docum CVE-2021-43586.1The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an unknown parameter in versions up to, and CVE-2021-435818.8An Out-of-Bounds Read vulnerability exists when reading a U3D file using Open Design Alliance PRC SDK before 2022.11. The specific issue exi CVE-2021-435827.8A Use-After-Free Remote Vulnerability exists when reading a DWG file using Open Design Alliance Drawings SDK before 2022.11. The specific is CVE-2021-435844.8DOM-based Cross Site Scripting (XSS vulnerability in 'Tail Event Logs' functionality in Nagios Nagios Cross-Platform Agent (NCPA) before 2.4 CVE-2021-435876.7Dell PowerPath Management Appliance, versions 3.2, 3.1, 3.0 P01, 3.0, and 2.6, use hard-coded cryptographic key. A local high-privileged mal CVE-2021-435887.5Dell EMC Data Protection Central version 19.5 contains an Improper Input Validation Vulnerability. A remote unauthenticated attacker could p CVE-2021-435896.7Dell EMC Unity, Dell EMC UnityVSA and Dell EMC Unity XT versions prior to 5.1.2.0.5.007 contain an operating system (OS) command injection V CVE-2021-43595.3The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary Post Deletion in versions up to, and including, 18 CVE-2021-435906.0Dell EMC Enterprise Storage Analytics for vRealize Operations, versions 4.0.1 to 6.2.1, contain a Plain-text password storage vulnerability.CVE-2021-43608.8The Controlled Admin Access plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.5 by not proper CVE-2021-436089.8Doctrine DBAL 3.x before 3.1.4 allows SQL Injection. The escaping of offset and length inputs to the generation of a LIMIT clause was not pr