CVE-2020-1955: 
Apache CouchDB vulnerability analysis and mitigation

Jenkins 2.251 and earlier, along with LTS 2.235.3 and earlier versions, contained a stored cross-site scripting (XSS) vulnerability identified as CVE-2020-2229 (SECURITY-1955). The vulnerability was discovered in the tooltip content of help icons, where the system failed to properly escape user-provided content (Jenkins Advisory).

The vulnerability stems from improper neutralization of input during web page generation, specifically in the tooltip content of help icons. The issue is classified as CWE-79 (Cross-site Scripting). The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating that it requires network access and user interaction to exploit (NVD).

The vulnerability allows for stored cross-site scripting attacks through tooltip content of help icons. Tooltip values can be contributed by plugins, some of which use user-specified values, potentially leading to the execution of malicious scripts in the context of other users' browsers (Jenkins Advisory).

The vulnerability was fixed in Jenkins 2.252 and LTS 2.235.4, which properly escape the tooltip content of help icons. Users are advised to upgrade to these or later versions to mitigate the vulnerability (Jenkins Advisory).