PT-2021-23883 · Jenkins · Jenkins Squash Tm Publisher Plugin+1

Daniel Beck · Published 2021-11-12 · Updated 2023-11-22 · CVE-2021-43578

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins Squash TM Publisher (Squash4Jenkins) Plugin versions 1.0.0 and earlier

Description The issue allows attackers who can control agent processes to replace arbitrary files on the Jenkins controller file system with an attacker-controlled JSON string. This is due to the lack of validation of input in an agent-to-controller message.

Recommendations For versions 1.0.0 and earlier, as a temporary workaround, consider disabling the agent-to-controller message functionality until a patch is available. Restrict access to the Jenkins controller file system to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

CVE-2021-43578

GHSA-H648-GJ34-5X4R

Affected Products

Jenkins

Jenkins Squash Tm Publisher Plugin

References · 9

• https://osv.dev/vulnerability/CVE-2021-43578 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h648-gj34-5x4r · Vendor Advisory
• https://jenkins.io/security/advisory/2021-11-12/#SECURITY-2525 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43578 · Security Note
• https://github.com/jenkinsci/squashtm-publisher-plugin · Note
• https://t.me/cvenotify/23322 · Telegram Post
• https://t.me/cibsecurity/32296 · Telegram Post
• http://openwall.com/lists/oss-security/2021/11/12/1 · Note
• https://t.me/cvenotify/23328 · Telegram Post