Credentials stored in plain text by Jenkins TraceTronic ECU-TEST Plugin

published 2021-01-13 5 y ago modified 2026-06-17 4 mo ago also GHSA-qvjr-x8fw-hghv , EUVD-2022-5036

cvss: 5.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 27%
public exploits: 0; none known

Jenkins TraceTronic ECU-TEST Plugin 2.23.1 and earlier stores credentials unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.

Patch / fix

fixed in 1 distros 1

maven de.tracetronic.jenkins.plugins:ecutest 2.24

jenkins Alpine 3.12 2.275-r0

alpine advisories ALPINE-CVE-2021-21612

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Exploit prediction

0.34% chance of exploitation in the next 30 days, higher than 27% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD	2.0	2.1	AV:L/AC:L/Au:N/C:P/I:N/A:N
GitHub	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
maven	de.tracetronic.jenkins.plugins:ecutest	<2.24	2.24

Affected products

Jenkins project Jenkins TraceTronic ECU-TEST Plugin

Classification

Weakness

CWE-522 Insufficiently Protected Credentials

References

jenkins.io /security/advisory/2021-01-13/#SECURITY-2057
web, vendor-advisory
nvd.nist.gov /vuln/detail/CVE-2021-21612
advisory
github.com /jenkinsci/ecutest-plugin
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary