CVE-2020-2165 Passwords transmitted in plain text by Jenkins Artifactory Plugin
An attacker with access to the Jenkins configuration form can view Artifactory passwords in plain text, leading to credential exposure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-2165?
CVE-2020-2165 is a high-severity vulnerability in Jfrog Artifactory, published on 25 Mar 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Jenkins Artifactory Plugin 3.6.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.
Weakness: CWE-522
Which versions are affected by CVE-2020-2165?
3 open source packages ship an affected version, including org.jenkins-ci.plugins:artifactory and artifactory. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:artifactory Maven | All versions | 3.6.1 |
org.jenkins-ci.plugins:artifactory Maven | All versions | 3.6.1 |
artifactory Bitnami | All versions | 3.6.1 |
Products include Jfrog Artifactory.
How do I fix CVE-2020-2165?
Upgrade org.jenkins-ci.plugins:artifactory to 3.6.1 or later.
Is CVE-2020-2165 being exploited?
There is no known exploitation of CVE-2020-2165 in the wild and no public exploit code.
Other vulnerabilities in Jfrog Artifactory
- CVE-2026-82329 JFrog Artifactory Improper Authentication
- CVE-2026-42016 JFrog Artifactory Incorrect Authorization
- CVE-2026-42018 JFrog Artifactory Improper Authentication
- CVE-2026-66384 JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory
- CVE-2019-17444 JFrog Artifactory does not enforce default admin password change
Sources
Also known as BIT-artifactory-2020-2165, GHSA-xqf6-5grh-6223.