CVE-2020-2213: 
Java vulnerability analysis and mitigation

The vulnerability CVE-2020-2213 affects the whitesource Plugin for Jenkins, discovered and disclosed on July 2, 2020. This security issue was identified in whitesource Plugin versions 19.1.1 and earlier, impacting Jenkins automation server installations using this plugin (Jenkins Advisory).

The vulnerability is classified with a Medium severity CVSS score. The core issue involves the insecure storage of credentials in plain text format within the plugin's global configuration file 'org.whitesource.jenkins.pipeline.WhiteSourcePipelineStep.xml' and job 'config.xml' files on the Jenkins controller (Jenkins Advisory).

The vulnerability exposes sensitive credentials to unauthorized access. Users with Extended Read permission can view credentials stored in job config.xml files, while users with access to the Jenkins controller file system can access credentials in both the global configuration and job configuration files (Jenkins Advisory).

The vulnerability can be exploited by users who have either Extended Read permission to Jenkins or access to the Jenkins controller file system. These users can directly view the plain text credentials stored in the affected configuration files (Jenkins Advisory).

As of the advisory's publication date on July 2, 2020, no fix was available for this vulnerability. Users of the whitesource Plugin should implement additional access controls to restrict access to the Jenkins controller file system and limit Extended Read permissions (Jenkins Advisory).