CVE-2020-2221: 
Java vulnerability analysis and mitigation

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier contains a stored cross-site scripting (XSS) vulnerability identified as CVE-2020-2221. The vulnerability was discovered and reported by Wadeck Follonier from CloudBees, Inc. and was publicly disclosed on July 15, 2020. The vulnerability affects the Jenkins core system, specifically in how it handles the display of upstream job names (Jenkins Advisory).

The vulnerability occurs because Jenkins fails to properly escape the upstream job's display name shown as part of a build cause. This results in a stored cross-site scripting (XSS) vulnerability that can be exploited by users who have Job/Configure permission. The vulnerability has been assigned a severity rating of High according to CVSS scoring system (Jenkins Advisory).

When successfully exploited, this vulnerability allows attackers with Job/Configure permission to execute arbitrary JavaScript code in the context of other users' browsers who view the affected build cause pages. This could potentially lead to session hijacking, credential theft, or other malicious actions (Jenkins Advisory).

The vulnerability is exploitable by users who have Job/Configure permission in Jenkins. The attacker would need to have sufficient privileges to configure jobs in the Jenkins instance to inject malicious scripts through the upstream job's display name (Jenkins Advisory, OSS Security).

The vulnerability has been fixed in Jenkins 2.245 and LTS 2.235.2, which properly escape the job display name. Users are strongly advised to upgrade to these versions or later to address this security issue. The fix involves implementing proper escaping mechanisms for the upstream job's display name (Jenkins Advisory).