CVE-2020-2164 Passwords stored in plain text by Jenkins Artifactory Plugin
Attackers with master file system access can read unencrypted Artifactory server passwords stored in the Jenkins plugin configuration.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-2164?
CVE-2020-2164 is a medium-severity vulnerability in Jfrog Artifactory, published on 25 Mar 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Jenkins Artifactory Plugin 3.5.0 and earlier stores its Artifactory server password unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with access to the master file system.
Weakness: CWE-522
Which versions are affected by CVE-2020-2164?
3 open source packages ship an affected version, including org.jenkins-ci.plugins:artifactory and artifactory. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:artifactory Maven | All versions | 3.6.0 |
org.jenkins-ci.plugins:artifactory Maven | All versions | 3.6.0 |
artifactory Bitnami | All versions | 3.5.1 |
Products include Jfrog Artifactory.
How do I fix CVE-2020-2164?
Upgrade org.jenkins-ci.plugins:artifactory to 3.6.0 or later.
Is CVE-2020-2164 being exploited?
There is no known exploitation of CVE-2020-2164 in the wild and no public exploit code.
Other vulnerabilities in Jfrog Artifactory
- CVE-2026-82329 JFrog Artifactory Improper Authentication
- CVE-2026-42016 JFrog Artifactory Incorrect Authorization
- CVE-2026-42018 JFrog Artifactory Improper Authentication
- CVE-2026-66384 JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory
- CVE-2019-17444 JFrog Artifactory does not enforce default admin password change
Sources
Also known as BIT-artifactory-2020-2164, GHSA-4q47-ph87-fq4f.