CVE-2020-2150: 
Java vulnerability analysis and mitigation

CVE-2020-2150 affects the Sonar Quality Gates Plugin for Jenkins, discovered and disclosed on March 9, 2020. This vulnerability impacts versions up to and including 1.3.1 of the plugin. The issue involves credentials being transmitted in plain text as part of the configuration form, despite being stored encrypted on disk (Jenkins Advisory, OSS Security).

The vulnerability occurs in the Sonar Quality Gates Plugin's global configuration handling. While credentials are stored encrypted in the configuration file org.quality.gates.jenkins.plugin.GlobalConfig.xml on the Jenkins controller, they are transmitted unencrypted in plain text when the configuration form is displayed. The severity is rated as Low according to CVSS scoring (Jenkins Advisory).

The exposure of credentials in plain text can potentially lead to credential compromise through browser extensions, cross-site scripting vulnerabilities, and similar attack vectors. This could allow unauthorized access to the Sonar system integrated with Jenkins (Jenkins Advisory).

As of the advisory publication on March 9, 2020, no fix was available for this vulnerability. Users should carefully control access to the Jenkins configuration interface and monitor for any suspicious activity related to Sonar authentication (Jenkins Advisory).