CVE-2020-2190: 
Java vulnerability analysis and mitigation

Jenkins Script Security Plugin version 1.72 and earlier contains a stored cross-site scripting (XSS) vulnerability (CVE-2020-2190) that was disclosed on June 3, 2020. The vulnerability affects the In-process Script Approval page where pending or approved classpath entries are not correctly escaped. This security issue impacts users who have access to configure sandboxed scripts in Jenkins (Jenkins Advisory, NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The core issue lies in the Script Security Plugin's failure to properly escape pending and approved classpath entries before they are rendered in the Jenkins UI on the In-process Script Approval page (NVD).

The vulnerability allows for stored cross-site scripting attacks that can be exploited by users who have permissions to configure sandboxed scripts. This could potentially lead to unauthorized access to sensitive information or execution of malicious code in the context of other users' browsers when they view the affected page (Jenkins Advisory).

The vulnerability requires an authenticated user with permissions to configure sandboxed scripts to exploit. The attack vector is through the manipulation of classpath entries that are then stored and displayed on the In-process Script Approval page (Jenkins Advisory).

The vulnerability was fixed in Script Security Plugin version 1.73, which properly escapes pending and approved classpath entries before rendering them in the Jenkins UI. Users are advised to upgrade to this version or later to address the security issue (Jenkins Advisory).