PT-2020-2658 · Jenkins · Jenkins Artifactory Plugin

Ethorsa + 1 · Published 2020-03-25 · Updated 2024-03-06 · CVE-2020-2164

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Artifactory Plugin versions 3.5.0 and earlier

Description The issue is related to the storage of the Artifactory server password in plain text in the global configuration file. This allows users with access to the Jenkins master file system to view the password. The vulnerability can be exploited by a remote attacker to obtain credentials. The password is stored unencrypted in the org.jfrog.hudson.ArtifactoryBuilder.xml file.

Recommendations For Jenkins Artifactory Plugin versions 3.5.0 and earlier, update to version 3.6.0 or later, which stores the Artifactory server password encrypted. As a temporary workaround, consider restricting access to the Jenkins controller file system to minimize the risk of exploitation.

Fix

Cleartext Storage of Sensitive Information

Insufficiently Protected Credentials

Weakness Enumeration

CWE-312

CWE-522

Related Identifiers

BDU:2020-02702

BIT-ARTIFACTORY-2020-2164

CVE-2020-2164

GHSA-4Q47-PH87-FQ4F

Affected Products

Jenkins Artifactory Plugin

References · 11

• https://osv.dev/vulnerability/GHSA-4q47-ph87-fq4f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-2164 · Security Note
• https://bdu.fstec.ru/vul/2020-02702 · Security Note
• https://osv.dev/vulnerability/BIT-artifactory-2020-2164 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-2164 · Vendor Advisory
• https://github.com/jenkinsci/artifactory-plugin · Note
• https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1542%20(1) · Note
• https://t.me/cvenotify/2139 · Telegram Post
• http://openwall.com/lists/oss-security/2020/03/25/2 · Note
• https://openwall.com/lists/oss-security/2020/03/25/2 · Note
• https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1542%20%281%29 · Note