CVE-2020-2145: 
Java vulnerability analysis and mitigation

CVE-2020-2145 affects the Jenkins Zephyr Enterprise Test Management Plugin versions 1.9.1 and earlier. The vulnerability was discovered and reported by Ian Williams, and was disclosed on March 9, 2020. This security issue impacts the Jenkins automation server plugin that integrates with Zephyr Enterprise Test Management (Jenkins Advisory).

The vulnerability is classified as a credentials exposure issue with a CVSS v3.1 Base Score of 5.5 (MEDIUM) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The technical issue involves the storage of Zephyr password in plain text within the global configuration file 'com.thed.zephyr.jenkins.reporter.ZeeReporter.xml' on the Jenkins controller file system (NVD).

The vulnerability allows users with access to the Jenkins controller file system to view the stored Zephyr password in plain text. This exposure of credentials could potentially lead to unauthorized access to Zephyr Enterprise Test Management systems (Jenkins Advisory).

The vulnerability was fixed in Zephyr Enterprise Test Management Plugin version 1.10, which integrates with the Jenkins Credentials Plugin for secure credential storage. Users should upgrade to this version or later to resolve the security issue (Jenkins Advisory).