CVE-2020-2149: Credentials transmitted in plain text by Repository Connector Plugin
Summary
CVE-2020-2149: Credentials transmitted in plain text by Repository Connector Plugin. Affects org.jenkins-ci.plugins:repository-connector versions < 2.0.0. Fixed in 2.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Repository Connector Plugin is a component of Jenkins, an open-source automation server. It allows users to connect to external repositories and retrieve artifacts for use in Jenkins pipelines. The plugin stores credentials in its global configuration file org.jvnet.hudson.plugins.repositoryconnector.RepositoryConfiguration.xml on the Jenkins controller. While the credentials are encrypted on disk, they are transmitted in plain text as part of the configuration form by Repository Connector Plugin versions 1.2.6 and earlier. This can lead to the exposure of sensitive credentials through browser extensions, cross-site scripting vulnerabilities, and similar situations.
Vulnerability Detail
The vulnerability in the Repository Connector Plugin arises from the transmission of credentials in plain text. When configuring the plugin, the credentials entered by the user are not properly protected during transmission, potentially allowing an attacker to intercept and obtain them. This vulnerability poses a risk of unauthorized access to external repositories and the sensitive data they contain. It is important to note that the credentials are stored encrypted on disk, so the vulnerability primarily affects the transmission of credentials rather than their storage.
How To Fix
Latest published version: 2.2.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid transmitting sensitive credentials by refraining from using the Repository Connector Plugin versions 1.2.6 and earlier. Instead, they can manually retrieve artifacts from external repositories and securely manage the credentials outside of the plugin. This can be achieved by using alternative methods such as scripting or other Jenkins plugins that provide secure credential management.
Conclusion
The vulnerability in the Repository Connector Plugin exposes credentials to potential interception during transmission. Upgrading to version 2.0.0 or later of the plugin is recommended to mitigate this risk. In the meantime, users can employ workarounds such as manually retrieving artifacts or using alternative secure credential management methods. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:repository-connector →
FAQ
The vulnerability allows for the potential exposure of sensitive credentials used to connect to external repositories. This can lead to unauthorized access to these repositories and the data they contain.
No, only versions 1.2.6 and earlier of the Repository Connector Plugin are affected. Versions 2.0.0 and later include a fix for this vulnerability.
There is no known exploit specifically targeting this vulnerability at this time. However, the transmission of credentials in plain text increases the risk of credential interception and potential unauthorized access.
Yes, this vulnerability can be exploited remotely. An attacker can intercept the plain text transmission of credentials over the network, potentially leading to unauthorized access to external repositories.
Yes, the CVSS score for this vulnerability is 3.1, indicating a low severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:repository-connector.
