CVE-2020-2113: 
Java vulnerability analysis and mitigation

Git Parameter Plugin version 0.9.11 and earlier contains a stored cross-site scripting (XSS) vulnerability identified as CVE-2020-2113. The vulnerability was discovered in February 2020 and affects the default value parameter in the plugin. The issue was fixed in Git Parameter Plugin version 0.9.12 (Jenkins Advisory).

The vulnerability stems from improper escaping of the default value parameter in the Git Parameter Plugin. When displaying these values on the user interface, the lack of proper escaping allows for potential cross-site scripting attacks. The issue has a CVSS severity rating of Medium (Jenkins Advisory).

This vulnerability could allow attackers with Job/Configure permission to execute stored cross-site scripting attacks through the plugin's default value parameter. The successful exploitation could lead to the execution of malicious JavaScript code in the context of other users' browsers who view the affected Jenkins interface (Jenkins Advisory).

The recommended mitigation is to upgrade Git Parameter Plugin to version 0.9.12 or later, which properly escapes the default value parameter shown on the UI. The fix was released on February 12, 2020 (Jenkins Advisory).