CVE-2020-2210: 
Java vulnerability analysis and mitigation

CVE-2020-2210 affects the Jenkins Stash Branch Parameter Plugin versions 0.3.0 and earlier. The vulnerability was discovered by Pavel Roskin and disclosed on July 2, 2020. This security issue involves the transmission of configured passwords in plain text as part of the plugin's global Jenkins configuration form, despite being stored encrypted on disk (Jenkins Advisory, OSS Security).

The vulnerability exists in the way the Stash Branch Parameter Plugin handles passwords in its global configuration file 'org.jenkinsci.plugins.StashBranchParameter.StashBranchParameterDefinition.xml' on the Jenkins controller. While the Stash API passwords are stored encrypted on disk, they are transmitted in plain text during configuration form submission. The vulnerability has been assigned a CVSS severity rating of Low (Jenkins Advisory).

The vulnerability can result in exposure of Stash API passwords through browser extensions, cross-site scripting vulnerabilities, and similar situations. This security issue only affects Jenkins installations before version 2.236, including 2.235.x LTS, as Jenkins 2.236 introduced a security hardening feature that transparently encrypts and decrypts data used for Jenkins password form fields (Jenkins Advisory).

The vulnerability can be exploited when users access the plugin's configuration form, potentially exposing passwords through browser extensions or cross-site scripting vulnerabilities (Jenkins Advisory).

As of the advisory publication date, no direct fix was available for this vulnerability. However, upgrading to Jenkins 2.236 or newer provides protection against this vulnerability through its security hardening feature that automatically encrypts and decrypts password form field data (Jenkins Advisory).