CVE-2020-2208: 
Java vulnerability analysis and mitigation

Jenkins Slack Upload Plugin version 1.7 and earlier contains a security vulnerability identified as CVE-2020-2208. The vulnerability was discovered and reported by Wasin Saengow, and was publicly disclosed on July 2, 2020. This vulnerability affects the Slack Upload Plugin for Jenkins, specifically versions up to and including 1.7 (Jenkins Advisory, NVD).

The vulnerability is classified as having Medium severity with a CVSS v3.1 Base Score of 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). The core issue involves the insecure storage of secrets in job config.xml files on the Jenkins controller, where they are stored in an unencrypted format (Jenkins Advisory).

The vulnerability exposes sensitive information as the unencrypted secrets in the config.xml files can be accessed by users who have Extended Read permission or by those who have access to the Jenkins controller file system (Jenkins Advisory).

The vulnerability can be exploited by users who either have Extended Read permission to Jenkins or have access to the Jenkins controller file system. The exploitation requires low attack complexity and low privileges (NVD).

As of the advisory publication date, no fix was available for this vulnerability. Users running affected versions of the Slack Upload Plugin should carefully review and restrict access to both Extended Read permissions and the Jenkins controller file system (Jenkins Advisory).