Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-21612

CVE-2021-21612:
Credentials stored in plain text by Jenkins TraceTronic ECU-TEST Plugin

5.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-21612
GHSA ID
GHSA-qvjr-x8fw-hghv
EPSS Score
0.05573%
CWE
CWE-522
Published
5/24/2022
Updated
10/27/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
de.tracetronic.jenkins.plugins:ecutestmaven<= 2.23.12.24

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper credential storage in ATXInstallation.xml. Jenkins plugins typically use Descriptor/configuration classes (like ATXInstallation) with XStream serialization. The functions responsible for persisting configuration data (configure()) and exposing credential fields (getCredentials()) would directly write sensitive values to disk unencrypted. The migration to 'sensitive options' in v2.24 implies these functions previously handled credentials as plain strings rather than using Jenkins' Secret class or credential APIs.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

J*nkins Tr***Troni* **U-T*ST Plu*in *.**.* *n* **rli*r stor*s *r***nti*ls un*n*rypt** in its *lo**l *on*i*ur*tion *il* `**.tr***troni*.j*nkins.plu*ins.**ut*st.r*port.*tx.inst*ll*tion.*TXInst*ll*tion.xml` on t** J*nkins *ontroll*r *s p*rt o* its *on*i

Reasoning

T** vuln*r**ility st*ms *rom improp*r *r***nti*l stor*** in *TXInst*ll*tion.xml. J*nkins plu*ins typi**lly us* **s*riptor/*on*i*ur*tion *l*ss*s (lik* *TXInst*ll*tion) wit* XStr**m s*ri*liz*tion. T** *un*tions r*sponsi*l* *or p*rsistin* *on*i*ur*tion