CVE-2020-2249: 
Java vulnerability analysis and mitigation

CVE-2020-2249 affects the Jenkins Team Foundation Server (TFS) Plugin versions 5.157.1 and earlier. The vulnerability was discovered by James Holderness from IB Boost and was publicly disclosed on September 1, 2020 (Jenkins Advisory).

The vulnerability is classified as a security issue where the TFS Plugin stores webhook secrets in an unencrypted format within its global configuration file (hudson.plugins.tfs.TeamPluginGlobalConfig.xml) on the Jenkins controller. The severity is rated as Low with a CVSS v3.1 base score of 3.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) (NVD).

The vulnerability exposes webhook secrets to potential unauthorized access. Attackers with access to the Jenkins controller file system can view these unencrypted secrets stored in the global configuration file (Jenkins Advisory).

The vulnerability requires local access to the Jenkins controller file system to be exploited. An attacker must have filesystem access to the Jenkins controller to view the unencrypted webhook secrets (OSS Security).

As of the advisory publication date, no fix was available for this vulnerability in the TFS Plugin. Users should implement additional security controls to restrict access to the Jenkins controller file system to minimize the risk (Jenkins Advisory).