CVE-2020-2131: 
Java vulnerability analysis and mitigation

Harvest SCM Plugin version 0.5.1 and earlier contains a security vulnerability (CVE-2020-2131) related to password storage in job configuration files. The vulnerability was disclosed on February 12, 2020, affecting the Jenkins Harvest SCM Plugin (Jenkins Advisory).

The vulnerability is classified with medium severity (CVSS) and involves the storage of SCM passwords in unencrypted form within job config.xml files on the Jenkins controller. This insecure storage practice exposes sensitive credentials in plaintext format (Jenkins Advisory).

The exposed credentials can be accessed by users with Extended Read permission who can view the job config.xml files, as well as by anyone with access to the Jenkins controller file system. This creates a potential security risk where unauthorized users could obtain valid SCM credentials (Jenkins Advisory).

As of the advisory publication date (February 12, 2020), no fix was available for this vulnerability. Users should implement access controls to restrict permissions to job configuration files and the Jenkins controller file system (Jenkins Advisory).