CVE-2020-2137: 
Java vulnerability analysis and mitigation

Jenkins Timestamper Plugin version 1.11.1 and earlier contains a stored cross-site scripting (XSS) vulnerability identified as CVE-2020-2137. The vulnerability was discovered and disclosed on March 9, 2020, affecting the HTML formatting functionality used for displaying timestamps in console output for builds (Jenkins Advisory, NVD).

The vulnerability stems from the plugin's failure to properly sanitize HTML formatting in its output when displaying timestamps in console output for builds. This creates a stored XSS vulnerability that can be exploited by users who have Overall/Administer permission. The issue has been assigned a CVSS severity rating of Medium (Jenkins Advisory).

When exploited, this vulnerability allows attackers with Overall/Administer permission to execute arbitrary JavaScript code in the context of other users' browsers who view the affected build console output. This could potentially lead to session hijacking, credential theft, or other malicious actions (Jenkins Advisory).

The vulnerability has been fixed in Timestamper Plugin version 1.11.2, which implements proper HTML sanitization for timestamps and only allows basic, safe HTML formatting. Users are advised to upgrade to this version or later to address the security issue (Jenkins Advisory).