CVE-2020-2291: 
Java vulnerability analysis and mitigation

CVE-2020-2291 affects the Jenkins couchdb-statistics Plugin versions 0.3 and earlier. The vulnerability was disclosed on October 8, 2020, and involves the insecure storage of server passwords in plaintext within the plugin's global configuration file (Jenkins Advisory, OSS Security).

The vulnerability stems from the plugin storing its server password unencrypted in the global configuration file 'org.jenkinsci.plugins.couchstats.CouchStatsConfig.xml' on the Jenkins controller. The severity is rated as Low with a CVSS v3.1 base score of 3.3 (Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) (NVD).

The vulnerability allows users with access to the Jenkins controller file system to view the stored server password in plaintext, potentially compromising the security of the connected CouchDB instance (Jenkins Advisory).

The vulnerability requires local access to the Jenkins controller file system to be exploited. No remote exploitation has been reported (Jenkins Advisory).

The issue has been fixed in couchdb-statistics Plugin version 0.4, which encrypts the server password once the configuration is saved. Users should upgrade to this version to resolve the vulnerability (Jenkins Advisory).

The vulnerability was discovered and reported by Long Nguyen from Viettel Cyber Security (Jenkins Advisory).