CVE-2020-2165
Passwords transmitted in plain text by Jenkins Artifactory Plugin
Jenkins Artifactory Plugin 3.6.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Jenkins Artifactory Plugin 3.6.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.
- Record
CVE-2020-2165- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-522
- Updated
- 2026-11-02
CVE List No score
Jenkins Artifactory Plugin 3.6.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.
- Record
CVE-2020-2165- Updated
- 2026-11-02
EUVDEUVD-2022-5841 No score
Jenkins Artifactory Plugin 3.6.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.
- Record
EUVD-2022-5841- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xqf6-5grh-6223
Passwords transmitted in plain text by Jenkins Artifactory Plugin
Jenkins Artifactory Plugin 3.6.0 and earlier stores Artifactory server passwords in its global configuration file org.jfrog.hudson.ArtifactoryBuilder.xml on the Jenkins controller as part of its configuration.
While the password is stored encrypted on disk since Artifactory Plugin 3.6.0, it is transmitted in plain text as part of the configuration form by Artifactory Plugin 3.6.0 and earlier. This can result in exposure of the password through browser extensions, cross-site scripting vulnerabilities, and similar situations.
Artifactory Plugin 3.6.1 transmits the password in its global configuration encrypted.
- Record
GHSA-xqf6-5grh-6223- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-319, CWE-522
- Updated
- 2026-11-02
OSV
Jenkins Artifactory Plugin 3.6.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.
- Record
CVE-2020-2165- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-xqf6-5grh-6223
Passwords transmitted in plain text by Jenkins Artifactory Plugin
Jenkins Artifactory Plugin 3.6.0 and earlier stores Artifactory server passwords in its global configuration file org.jfrog.hudson.ArtifactoryBuilder.xml on the Jenkins controller as part of its configuration.
While the password is stored encrypted on disk since Artifactory Plugin 3.6.0, it is transmitted in plain text as part of the configuration form by Artifactory Plugin 3.6.0 and earlier. This can result in exposure of the password through browser extensions, cross-site scripting vulnerabilities, and similar situations.
Artifactory Plugin 3.6.1 transmits the password in its global configuration encrypted.
- Record
GHSA-xqf6-5grh-6223- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-319, CWE-522
- Updated
- 2026-11-02
OSVBIT-artifactory-2020-2165 No score
Jenkins Artifactory Plugin 3.6.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.
- Record
BIT-artifactory-2020-2165- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:artifactoryMaven |
before 3.6.1 | 3.6.1 |
artifactoryBitnami |
before 3.6.1 | 3.6.1 |
org.jenkins-ci.plugins:artifactoryMaven |
before 3.6.1, plus listed versions 2.0.02.0.12.0.22.0.32.0.4 Show 45 moreShow less2.0.52.0.62.0.72.0.82.0.92.1.02.1.12.1.22.1.32.1.42.1.52.1.62.1.72.1.82.10.02.10.12.10.22.10.32.10.42.11.02.12.02.12.12.12.22.13.02.13.12.14.02.15.02.15.12.16.02.16.12.16.22.2.02.2.12.2.22.2.32.2.42.2.52.2.62.2.72.3.02.3.12.4.02.4.12.4.22.4.3 |
3.6.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-2165 is a high vulnerability (CVSS 7.5) in Jenkins Project Artifactory Plugin, published March 25, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.09%, the 65th percentile. Fixed in org.jenkins-ci.plugins:artifactory 3.6.1.
References
Left out here: 32 versions. The JSON record has them.