CVE-2020-2127: 
Java vulnerability analysis and mitigation

CVE-2020-2127 is a security vulnerability affecting the BMC Release Package and Deployment Plugin version 1.1 and earlier for Jenkins. The vulnerability was disclosed on February 12, 2020, and is identified as SECURITY-1547. The vulnerability affects the plugin's handling of RPD user tokens in its global configuration (Jenkins Advisory).

The vulnerability has been assigned a Low severity rating based on CVSS scoring. The issue stems from the plugin storing the RPD user token unencrypted in its global configuration file 'com.bmc.rpd.jenkins.plugin.bmcrpd.configuration.RPDPluginConfiguration.xml' on the Jenkins controller (Jenkins Advisory).

The vulnerability exposes the RPD user token to unauthorized access. The credential can be viewed by users who have access to the Jenkins controller file system, potentially leading to unauthorized access to BMC Release Package and Deployment services (Jenkins Advisory).

The vulnerability requires local access to the Jenkins controller file system to be exploited. It cannot be exploited remotely without authentication (Jenkins Advisory).

As of the advisory's publication date (February 12, 2020), no fix was available for this vulnerability. Users should restrict access to the Jenkins controller file system and monitor for unauthorized access to the configuration files (Jenkins Advisory).

The vulnerability was discovered and reported by James Holderness of IB Boost, demonstrating the security community's active involvement in identifying Jenkins plugin vulnerabilities (Jenkins Advisory).