CVE-2020-2165: High severity JFrog Artifactory Jenkins vulnerability
Jenkins Artifactory Plugin 3.6.0 and earlier stores Artifactory server passwords in its global configuration file org.jfrog.hudson.ArtifactoryBuilder.xml on the Jenkins controller as part of its configuration.
While the password is stored encrypted on disk since Artifactory Plugin 3.6.0, it is transmitted in plain text as part of the configuration form by Artifactory Plugin 3.6.0 and earlier. This can result in exposure of the password through browser extensions, cross-site scripting vulnerabilities, and similar situations.
Artifactory Plugin 3.6.1 transmits the password in its global configuration encrypted.
Other sources
Jenkins Artifactory Plugin 3.6.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.jenkins-ci.plugins:artifactoryto a version that resolves this vulnerability.Fixed in 3.6.1 - Upgrade
Upgrade
Jenkins Artifactory Pluginto a version that resolves this vulnerability.Fixed in 3.6.1 - Operational
After upgrading, rotate any Artifactory server passwords that may have been exposed via the Jenkins global configuration form in Jenkins Artifactory Plugin 3.6.0 and earlier (potential exposure via browser extensions, cross-site scripting, or similar situations).
Event History
Frequently Asked Questions
What is the severity of CVE-2020-2165?
The severity of CVE-2020-2165 is high.
What is the vulnerability description of CVE-2020-2165?
CVE-2020-2165 is a vulnerability in the Jenkins Artifactory Plugin where it transmits configured passwords in plain text as part of its configuration.
How does CVE-2020-2165 affect Jfrog Artifactory?
CVE-2020-2165 affects Jfrog Artifactory versions up to and including 3.6.0.
How can I fix CVE-2020-2165?
To fix CVE-2020-2165, you should upgrade to Jfrog Artifactory version 3.6.1 or later.
Are there any references for CVE-2020-2165?
Yes, you can find more information about CVE-2020-2165 in the following references: [Reference 1](http://www.openwall.com/lists/oss-security/2020/03/25/2), [Reference 2](https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1542%20(2)), [Reference 3](https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1542%20%282%29).