CVE-2020-2165

The Jenkins Artifactory Plugin versions 3.6.0 and earlier transmit configured passwords in plain text as part of the global Jenkins configuration form. This means that when an administrator views or submits the form, the password field is sent without encryption, potentially exposing it to anyone with access to the form or who can intercept network traffic [1][2].

An attacker who can view the configuration page or monitor network traffic can easily obtain the cleartext passwords. No special privileges are required beyond network access or the ability to view the Jenkins configuration UI. The attack is low complexity and does not require authentication if the attacker can already access the UI [1][3].

This vulnerability could lead to the compromise of Artifactory server credentials, allowing an attacker to authenticate to the artifact repository and potentially access, modify, or delete build artifacts. This could further enable supply chain attacks or lateral movement within the infrastructure [2].

The issue has been fixed in Artifactory Plugin version 3.6.1. Users are strongly advised to upgrade immediately. There is no reported workaround for this vulnerability [3].