CVE-2021-43578: vulnerability in Jenkins Squash TM Publisher (Squash4Jenkins)…
Published · Updated
Follow this CVE+ Monitor Jenkins Squash TM Publisher Plugin+ Monitor org.jenkins-ci.plugins:squashtm-publisher-plugin
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 1.1%
Jenkins Squash TM Publisher (Squash4Jenkins) Plugin 1.0.0 and earlier implements an agent-to-controller message that does not implement any validation of its input, allowing attackers able to control agent processes to replace arbitrary files on the Jenkins controller file system with an attacker-controlled JSON string.
Related CVEs — Jenkins Squash TM Publisher (Squash4Jenkins)…
In the same product, most dangerous first.