medium5.5
CVE-2021-21612
Credentials stored in plain text by Jenkins TraceTronic ECU-TEST Plugin
Impact
Jenkins TraceTronic ECU-TEST Plugin 2.23.1 and earlier stores credentials unencrypted in its global configuration file `de.tracetronic.jenkins.plugins.ecutest.report.atx.installation.ATXInstallation.xml` on the Jenkins controller as part of its configuration. These credentials can be viewed by users with access to the Jenkins controller file system. Jenkins TraceTronic ECU-TEST Plugin 2.24 adds a new option type for sensitive options. Previously stored credentials are migrated to that option type on Jenkins startup.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | de.tracetronic.jenkins.plugins:ecutest | <= 2.23.1 | 2.24 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Tracetronic Ecu-Test | through 2.23.1 |