CVE-2020-2194: 
Java vulnerability analysis and mitigation

CVE-2020-2194 is a stored cross-site scripting (XSS) vulnerability discovered in Jenkins ECharts API Plugin versions 4.7.0-3 and earlier. The vulnerability was disclosed on June 3, 2020, and affects the plugin's trend chart functionality where the display name of builds is not properly escaped (Jenkins Advisory).

The vulnerability exists due to improper escaping of build display names in the trend chart feature of the ECharts API Plugin. The issue has been assigned a CVSS v3.1 Base Score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (NVD).

This vulnerability can be exploited by users with Run/Update permission to execute stored cross-site scripting attacks through the manipulation of build display names in the trend chart. The successful exploitation could lead to unauthorized access to sensitive information and potential manipulation of the Jenkins interface (Jenkins Advisory).

The vulnerability can be exploited by users who have Run/Update permission in the Jenkins environment. The attack requires the ability to modify build display names that are then rendered in the trend chart (Jenkins Advisory).

The vulnerability has been fixed in ECharts API Plugin version 4.7.0-4, which properly escapes the display name of builds in the trend chart. Users are advised to upgrade to this version or later to address the security issue (Jenkins Advisory).