{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.0.0"}],"component":"org.jenkins-ci.plugins:squashtm-publisher-plugin","cve_ids":["CVE-2021-43578"],"ecosystem":"Maven","epss":0.01104,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-h648-gj34-5x4r","id":"tcs_01M5N8ZSXJFXPKGDBYK81KQX77","modified_at":"2023-11-08T04:07:11.016291Z","published_at":"2022-05-24T19:20:32Z","references":["https://osv.dev/vulnerability/GHSA-h648-gj34-5x4r","https://nvd.nist.gov/vuln/detail/CVE-2021-43578","https://github.com/jenkinsci/squashtm-publisher-plugin","https://www.jenkins.io/security/advisory/2021-11-12/#SECURITY-2525","http://www.openwall.com/lists/oss-security/2021/11/12/1"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-h648-gj34-5x4r","url":"https://osv.dev/vulnerability/GHSA-h648-gj34-5x4r"}],"summary":"Agent-to-controller security bypass in Jenkins Squash TM Publisher (Squash4Jenkins) Plugin allows writing arbitrary files"}