Jenkins Tracetronic Ecu-Test vulnerabilities

3 CVEs affecting Jenkins Tracetronic Ecu-Test, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-21612, published 2021-01-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-1999025, published 2018-08-01. High severity, CVSS 7.4. EPSS: 0.9% chance of exploitation in the next 30 days. A man in the middle vulnerability exists in Jenkins TraceTronic ECU-TEST Plugin 2.3 and earlier in ATXPublisher.java, ATXValidator.java that allows attackers to impersonate any service that Jenkins…
CVE-2018-1999026, published 2018-08-01. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. A server-side request forgery vulnerability exists in Jenkins TraceTronic ECU-TEST Plugin 2.3 and earlier in ATXPublisher.java that allows attackers to have Jenkins send HTTP requests to an…
CVE-2021-21612, published 2021-01-13. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. Jenkins TraceTronic ECU-TEST Plugin 2.23.1 and earlier stores credentials unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the…