CVE-2020-2297: 
Java vulnerability analysis and mitigation

CVE-2020-2297 affects the SMS Notification Plugin for Jenkins, discovered in October 2020. The vulnerability was identified in versions 1.2 and earlier of the plugin, where an access token is stored unencrypted in the global configuration file on the Jenkins controller (Jenkins Advisory).

The vulnerability involves the insecure storage of an access token in plaintext within the global configuration file 'com.hoiio.jenkins.plugin.SMSNotification.xml' on the Jenkins controller. The severity is rated as Low according to the CVSS scoring system (Jenkins Advisory).

The vulnerability allows users with access to the Jenkins controller file system to view the unencrypted access token stored in the configuration file. This could potentially lead to unauthorized access to SMS notification services (Jenkins Advisory).

The vulnerability requires local access to the Jenkins controller file system to be exploited. It is not remotely exploitable without authentication (Jenkins Advisory).

As of the advisory's publication date (October 8, 2020), no fix was available for this vulnerability. Users should implement strict access controls to the Jenkins controller file system to minimize the risk (Jenkins Advisory).