vulnerability

Jenkins Advisory 2021-01-13: CVE-2021-21614: Credentials stored in plain text by Bumblebee HP ALM Plugin

Try Surface Command

Back to search

Severity

CVSS

(AV:L/AC:L/Au:N/C:P/I:N/A:N)

Published

Jan 13, 2021

Added

Dec 2, 2021

Modified

Mar 27, 2026

Description

Jenkins Bumblebee HP ALM Plugin 4.1.5 and earlier stores credentials unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.

Solutions

jenkins-lts-upgrade-2_263_2jenkins-upgrade-2_275

References

CVE-2021-21614
https://attackerkb.com/topics/CVE-2021-21614
CWE-522
EUVD-EUVD-2022-3233
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-3233
https://jenkins.io/security/advisory/2021-01-13/

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report