CVE-2020-2128: 
Java vulnerability analysis and mitigation

CVE-2020-2128 (SECURITY-1549) affects the ECX Copy Data Management Plugin version 1.9 and earlier in Jenkins. The vulnerability was discovered by James Holderness of IB Boost and was publicly disclosed on February 12, 2020. This security issue impacts the Jenkins automation server's plugin system, specifically affecting the catalogic-ecx plugin (Jenkins Advisory).

The vulnerability is classified with Medium severity (CVSS) and involves the insecure storage of service passwords. The ECX Copy Data Management Plugin stores service passwords unencrypted in job config.xml files as part of its configuration, creating a security risk (Jenkins Advisory).

The exposed credentials can be accessed by users with Extended Read permission or by anyone with access to the Jenkins controller file system. This vulnerability potentially allows unauthorized users to view sensitive service passwords, which could lead to unauthorized access to connected services (Jenkins Advisory).

As of the advisory publication date, no fix was available for this vulnerability. Users of the ECX Copy Data Management Plugin should implement additional access controls to restrict access to the Jenkins controller file system and carefully manage Extended Read permissions (Jenkins Advisory).