Passwords stored in plain text by Jenkins Artifactory Plugin

🗓️ 24 May 2022 17:12:40Reported by GitHub Advisory DatabaseType

Passwords stored in plain text by Jenkins Artifactory Plugin. Artifactory Plugin 3.5.0 and earlier stores its Artifactory server password in plain text in the global configuration file `org.jfrog.hudson.ArtifactoryBuilder.xml`. This password can be viewed by users with access to the Jenkins controller file system. Artifactory Plugin 3.6.0 now stores the Artifactory server password encrypted. This change is effective once the global configuration is saved the next time

Reporter	Title	Published	Views	Family All 10
CNVD	CloudBees Jenkins Artifactory Plugin Information Disclosure Vulnerability	26 Mar 202000:00	–	cnvd
CVE	CVE-2020-2164	25 Mar 202016:05	–	cve
Cvelist	CVE-2020-2164	25 Mar 202016:05	–	cvelist
EUVD	EUVD-2022-2426	3 Oct 202520:07	–	euvd
NVD	CVE-2020-2164	25 Mar 202017:15	–	nvd
OSV	BIT-ARTIFACTORY-2020-2164	6 Mar 202410:53	–	osv
OSV	GHSA-4Q47-PH87-FQ4F Passwords stored in plain text by Jenkins Artifactory Plugin	24 May 202217:12	–	osv
Prion	Design/Logic Flaw	25 Mar 202017:15	–	prion
Positive Technologies	PT-2020-2658 · Jenkins · Jenkins Artifactory Plugin	25 Mar 202000:00	–	ptsecurity
RedhatCVE	CVE-2020-2164	22 May 202516:29	–	redhatcve

Vulners

Node

org.jenkins-ci.plugins artifactoryRange<3.6.0maven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2020-2164
jenkins	www.jenkins.io/security/advisory/2020-03-25/
openwall	www.openwall.com/lists/oss-security/2020/03/25/2
github	www.github.com/advisories/GHSA-4q47-ph87-fq4f

26 Oct 2023 21:54Current

6.3Medium risk

Vulners AI Score6.3

CVSS 24

CVSS 3.16.5

EPSS0.00258