CVE-2020-2143: 
Java vulnerability analysis and mitigation

CVE-2020-2143 affects the Jenkins Logstash Plugin versions 2.3.1 and earlier. The vulnerability was discovered and disclosed on March 9, 2020, and involves the transmission of credentials in plain text as part of the plugin's global Jenkins configuration form (Jenkins Advisory, OSS Security).

The vulnerability exists in the way the Logstash Plugin handles credentials in its global configuration file 'jenkins.plugins.logstash.LogstashConfiguration.xml' on the Jenkins controller. While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration form, which could lead to credential exposure (Jenkins Advisory).

The vulnerability has been assessed as having a Low severity (CVSS) rating. The exposure of credentials through plain text transmission could potentially be exploited through browser extensions, cross-site scripting vulnerabilities, and similar situations (Jenkins Advisory).

The vulnerability has been fixed in Logstash Plugin version 2.3.2, which implements encrypted transmission of credentials in its global configuration. Users are advised to upgrade to this version or later to address the security issue (Jenkins Advisory).