CVE-2020-2259: 
Java vulnerability analysis and mitigation

The Jenkins computer-queue-plugin Plugin version 1.5 and earlier contains a stored cross-site scripting (XSS) vulnerability identified as CVE-2020-2259. The vulnerability was discovered and disclosed on September 16, 2020, affecting the computer-queue-plugin Plugin component of Jenkins automation server (Jenkins Advisory, NVD).

The vulnerability stems from the plugin's failure to properly escape agent names in tooltips, which creates a stored cross-site scripting vulnerability. The severity of this vulnerability is rated as High according to the CVSS scoring system (Jenkins Advisory).

When exploited, this vulnerability allows attackers with Agent/Configure permission to execute cross-site scripting attacks through the manipulation of agent names in tooltips (Jenkins Advisory).

The vulnerability is exploitable by attackers who have Agent/Configure permission in the Jenkins environment. The attack vector involves manipulating agent names that are displayed in tooltips (Jenkins Advisory).

The vulnerability has been fixed in computer-queue-plugin Plugin version 1.6, which properly escapes the agent name in tooltips. Users are advised to upgrade to this version to mitigate the vulnerability (Jenkins Advisory).