CVE-2020-2170: 
Java vulnerability analysis and mitigation

CVE-2020-2170 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Jenkins RapidDeploy Plugin versions 4.2 and earlier. The vulnerability was discovered and reported by Daniel Beck from CloudBees, Inc., and was publicly disclosed on March 25, 2020 (Jenkins Advisory, OSS Security).

The vulnerability occurs because the RapidDeploy Plugin fails to properly escape package names in its displayed table of packages obtained from a remote server. This vulnerability has been assigned a CVSS v3.1 Base Score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (NVD).

When exploited, this vulnerability allows for stored cross-site scripting (XSS) attacks that can be triggered by users who have permissions to configure jobs. The vulnerability could potentially allow attackers to execute malicious scripts in the context of other users' browsers when viewing the affected package table (Jenkins Advisory).

The vulnerability has been fixed in RapidDeploy Plugin version 4.2.1, which properly escapes package names. Users are advised to update to this version or later to address the security issue (Jenkins Advisory).