CVE-2020-2164: Medium severity JFrog Artifactory Jenkins vulnerability
Artifactory Plugin 3.5.0 and earlier stores its Artifactory server password in plain text in the global configuration file org.jfrog.hudson.ArtifactoryBuilder.xml. This password can be viewed by users with access to the Jenkins controller file system.
Artifactory Plugin 3.6.0 now stores the Artifactory server password encrypted. This change is effective once the global configuration is saved the next time.
Other sources
Jenkins Artifactory Plugin 3.5.0 and earlier stores its Artifactory server password unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with access to the master file system.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.jenkins-ci.plugins:artifactoryto a version that resolves this vulnerability.Fixed in 3.6.0 - Upgrade
Upgrade
Jenkins Artifactory Pluginto a version that resolves this vulnerability.Fixed in 3.6.0 - Compensating control
Restrict access to the Jenkins controller/master file system (where the global configuration file org.jfrog.hudson.ArtifactoryBuilder.xml can be viewed by users with access).
- Operational
On the Jenkins controller/master, save the global configuration again so the Artifactory server password is re-stored using the encrypted form (change takes effect once the global configuration is saved the next time).
Event History
Frequently Asked Questions
What is CVE-2020-2164?
CVE-2020-2164 is a vulnerability in the Jenkins Artifactory Plugin 3.5.0 and earlier that stores its Artifactory server password unencrypted in the global configuration file, allowing users with access to the Jenkins controller file system to view the password.
What is the severity of CVE-2020-2164?
The severity of CVE-2020-2164 is medium with a CVSS score of 6.5.
How does CVE-2020-2164 affect JFrog Artifactory?
CVE-2020-2164 affects JFrog Artifactory when it is integrated with Jenkins using the vulnerable versions of the Artifactory Plugin (3.5.0 and earlier).
How can I fix CVE-2020-2164?
To fix CVE-2020-2164, upgrade to a version of the Artifactory Plugin that is not affected, such as version 3.6.0 or later.
Where can I find more information about CVE-2020-2164?
You can find more information about CVE-2020-2164 in the references provided: [1] [2] [3].