CVE-2020-2164: 
Java vulnerability analysis and mitigation

CVE-2020-2164 affects the Jenkins Artifactory Plugin versions 3.5.0 and earlier. The vulnerability was discovered by James Holderness from IB Boost and independently by ethorsa, and was disclosed on March 25, 2020. This security issue impacts the Jenkins automation server's Artifactory Plugin, which is used for integrating Jenkins with JFrog Artifactory (Jenkins Advisory, OSS Security).

The vulnerability stems from the Artifactory Plugin storing its Artifactory server password in plain text within the global configuration file 'org.jfrog.hudson.ArtifactoryBuilder.xml' on the Jenkins master/controller file system. The severity is rated as Low according to CVSS scoring, with a CVSS v3.1 base score of 6.5 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) (Jenkins Advisory).

The vulnerability allows users with access to the Jenkins controller file system to view the Artifactory server password stored in plain text. This could potentially lead to unauthorized access to the Artifactory server and its resources (Jenkins Advisory).

The vulnerability was fixed in Artifactory Plugin version 3.6.0, which now stores the Artifactory server password in encrypted form. Users should upgrade to version 3.6.1 or later to receive both the encryption fix and additional security improvements. The encryption of existing passwords takes effect once the global configuration is saved after the upgrade (Jenkins Advisory).