CVE-2020-2165: 
Java vulnerability analysis and mitigation

CVE-2020-2165 affects the Jenkins Artifactory Plugin versions 3.6.0 and earlier. The vulnerability was discovered and disclosed on March 25, 2020, impacting the plugin's handling of Artifactory server passwords in its global configuration form (Jenkins Advisory, NVD).

The vulnerability stems from the Artifactory Plugin transmitting configured passwords in plain text as part of its global Jenkins configuration form, despite being stored encrypted on disk since version 3.6.0. The vulnerability has a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (NVD).

The transmission of passwords in plain text can result in exposure of credentials through browser extensions, cross-site scripting vulnerabilities, and similar situations. This could potentially lead to unauthorized access to Artifactory servers (Jenkins Advisory).

The vulnerability was fixed in Artifactory Plugin version 3.6.1, which implements encrypted transmission of passwords in its global configuration. Users are advised to upgrade to this version or later to address the security issue (Jenkins Advisory).