CVE-2020-2149: 
Java vulnerability analysis and mitigation

Jenkins Repository Connector Plugin version 1.2.6 and earlier contains a security vulnerability (CVE-2020-2149) discovered in March 2020. The vulnerability involves the transmission of configured credentials in plain text as part of its global Jenkins configuration form, despite being stored encrypted on disk (Jenkins Advisory, OSS Security).

The vulnerability exists in the Repository Connector Plugin's global configuration file 'org.jvnet.hudson.plugins.repositoryconnector.RepositoryConfiguration.xml' on the Jenkins controller. While the credentials are stored in an encrypted format on disk, they are transmitted as plain text when the configuration form is loaded or submitted. The vulnerability has been assigned a CVSS severity rating of Low (Jenkins Advisory).

The exposure of credentials in plain text can potentially lead to credential compromise through various attack vectors, including browser extensions and cross-site scripting vulnerabilities. This could allow attackers to gain unauthorized access to resources protected by these credentials (Jenkins Advisory).

As of the advisory publication date, there was no fix available for this vulnerability in the Repository Connector Plugin. Users should assess their risk and consider implementing additional security controls to protect credential transmission (Jenkins Advisory).