CVE-2021-21612

Description

Jenkins TraceTronic ECU-TEST Plugin 2.23.1 and earlier stores credentials unencrypted in its global configuration file `de.tracetronic.jenkins.plugins.ecutest.report.atx.installation.ATXInstallation.xml` on the Jenkins controller as part of its configuration. These credentials can be viewed by users with access to the Jenkins controller file system. Jenkins TraceTronic ECU-TEST Plugin 2.24 adds a new option type for sensitive options. Previously stored credentials are migrated to that option type on Jenkins startup.

Affected packages (1)

• Maven/de.tracetronic.jenkins.plugins:ecutestfrom 0, < 2.24

CVSS scores

References (3)

• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2021-21612
• PATCHhttps://github.com/jenkinsci/ecutest-plugin
• WEBhttps://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2057