CVE-2020-2205: 
Java vulnerability analysis and mitigation

The VncRecorder Plugin version 1.25 and earlier contains a stored cross-site scripting (XSS) vulnerability identified as CVE-2020-2205. The vulnerability was discovered and disclosed on July 2, 2020, affecting the Jenkins VncRecorder Plugin's checkVncServ form validation endpoint. This security issue impacts Jenkins administrators who interact with job configuration forms (Jenkins Advisory, OSS Security).

The vulnerability stems from the plugin's failure to properly escape a tool path in the checkVncServ form validation endpoint when accessed through job configuration forms. The severity is rated as Medium with a CVSS v3.1 base score of 4.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) and a CVSS v2.0 score of 3.5 (AV:N/AC:M/Au:S/C:N/I:P/A:N). The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (NVD).

The vulnerability allows for stored cross-site scripting (XSS) attacks that can be exploited by Jenkins administrators. When successfully exploited, this could lead to the execution of arbitrary JavaScript code in the context of other users' browsers who access the affected job configuration forms (Jenkins Advisory).

The vulnerability is exploitable by users with Jenkins administrator privileges through the job configuration forms. The attack requires high privileges (administrator access) and user interaction for successful exploitation (NVD).

The vulnerability has been fixed in VncRecorder Plugin version 1.35, which properly escapes the tool path. Users are advised to upgrade to this version to mitigate the security risk (Jenkins Advisory).