CVE-2021-21612: 
Java vulnerability analysis and mitigation

The CVE-2021-21612 vulnerability affects the tracetronic ecu.test Plugin for Jenkins, versions 2.23.1 and earlier. The vulnerability was discovered and disclosed on January 13, 2021. This security issue involves the storage of unencrypted credentials in the plugin's global configuration file on the Jenkins controller (Jenkins Advisory).

The vulnerability stems from the plugin storing credentials in plaintext within the global configuration file 'de.tracetronic.jenkins.plugins.ecutest.report.atx.installation.ATXInstallation.xml' on the Jenkins controller. The severity is rated as Low according to the CVSS scoring system. The vulnerability allows exposure of sensitive credentials to users who have access to the Jenkins controller file system (Jenkins Advisory).

Users with access to the Jenkins controller file system can view the unencrypted credentials stored in the plugin's configuration file. This exposure of sensitive credentials could potentially lead to unauthorized access to connected systems or services (Jenkins Advisory).

The vulnerability requires local access to the Jenkins controller file system to be exploited. It cannot be exploited remotely without authentication, making it a relatively low-risk vulnerability in terms of exploitability (Jenkins Advisory).

The vulnerability was fixed in tracetronic ecu.test Plugin version 2.24, which introduced a new option type for sensitive options. Upon upgrading, previously stored credentials are automatically migrated to the new secure option type during Jenkins startup. Users should upgrade to version 2.24 or later to resolve this security issue (Jenkins Advisory).