PT-2021-14655 · Jenkins · Jenkins Tracetronic Ecu-Test Plugin+1

Long Nguyen · Published 2021-01-13 · Updated 2023-10-25 · CVE-2021-21612

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins TraceTronic ECU-TEST Plugin versions 2.23.1 and earlier

Description The issue allows credentials to be stored unencrypted in the global configuration file on the Jenkins controller, making them accessible to users with access to the Jenkins controller file system. The configuration file de.tracetronic.jenkins.plugins.ecutest.report.atx.installation.ATXInstallation.xml stores these credentials as part of its configuration.

Recommendations For Jenkins TraceTronic ECU-TEST Plugin versions 2.23.1 and earlier, update to version 2.24 or later, which adds a new option type for sensitive options and migrates previously stored credentials to this option type on Jenkins startup.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2021-21612

GHSA-QVJR-X8FW-HGHV

Affected Products

Jenkins

Jenkins Tracetronic Ecu-Test Plugin

References · 6

• https://jenkins.io/security/advisory/2021-01-13/#SECURITY-2057 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21612 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qvjr-x8fw-hghv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21612 · Security Note
• https://github.com/jenkinsci/ecutest-plugin · Note
• https://t.me/cibsecurity/22089 · Telegram Post