CVE-2020-2149 Credentials transmitted in plain text by Repository Connector Plugin

What is CVE-2020-2149?

CVE-2020-2149 is a medium-severity vulnerability in Jenkins Repository Connector Plugin, published on 9 Mar 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Jenkins Repository Connector Plugin 1.2.6 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.

Weakness: CWE-319

Which versions are affected by CVE-2020-2149?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:repository-connector. It affects 1 product.

Products include Jenkins Repository Connector.

How do I fix CVE-2020-2149?

Upgrade org.jenkins-ci.plugins:repository-connector to 2.0.0 or later.

Is CVE-2020-2149 being exploited?

There is no known exploitation of CVE-2020-2149 in the wild and no public exploit code.

Other vulnerabilities in Jenkins Repository Connector Plugin

• CVE-2019-1003038 Jenkins Repository Connector Plugin has insufficiently protected credentials High 7.8
• CVE-2022-34195 Cross-site Scripting in Jenkins Repository Connector Plugin Medium 5.4
• CVE-2021-21618 Stored XSS vulnerability in Jenkins Repository Connector Plugin Medium 5.4
• CVE-2022-36903 Jenkins Repository Connector Plugin allows attackers with Overall/Read permission to enumerate credentials IDs Medium 4.3
• CVE-2022-36904 Jenkins Repository Connector Plugin does not perform a permission check in a method implementing form validation Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4fjc-fwj2-7xfg.