CVE-2020-2230: 
Java vulnerability analysis and mitigation

CVE-2020-2230 is a stored cross-site scripting (XSS) vulnerability discovered in Jenkins, affecting versions 2.251 and earlier, as well as LTS 2.235.3 and earlier. The vulnerability was disclosed on August 12, 2020, and stems from the application's failure to properly escape the project naming strategy description that is displayed during item creation (Jenkins Advisory).

The vulnerability is classified as a stored XSS vulnerability with a High severity rating. The issue occurs because Jenkins fails to properly escape the project naming strategy description that is displayed during item creation. The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (NVD).

The vulnerability allows for stored cross-site scripting attacks that can be exploited by users who have Overall/Manage permission in the Jenkins system. When successfully exploited, this could lead to execution of arbitrary JavaScript code in the context of other users' browsers who view the affected project naming strategy description (Jenkins Advisory).

The vulnerability is exploitable by users who have Overall/Manage permission in the Jenkins system. The attack requires the attacker to have sufficient privileges to modify the project naming strategy description, and victims must view the affected page for the exploit to be triggered (Jenkins Advisory).

The vulnerability has been fixed in Jenkins 2.252 and Jenkins LTS 2.235.4. The fix involves properly escaping the project naming strategy description. Users are advised to upgrade to these versions or later to address the vulnerability (Jenkins Advisory).

The vulnerability was reported by Pierre Beitz from CloudBees, Inc., demonstrating the active security research within the Jenkins community. The Jenkins project promptly addressed the vulnerability through their security advisory process (Jenkins Advisory).