CVE-2020-2262: 
Java vulnerability analysis and mitigation

CVE-2020-2262 is a stored cross-site scripting (XSS) vulnerability discovered in the Jenkins Android Lint Plugin versions 2.6 and earlier. The vulnerability was disclosed on September 16, 2020, affecting the plugin's post-build step functionality (Jenkins Advisory, OSS Security).

The vulnerability stems from the plugin's failure to escape annotation messages in tooltips, which creates a stored XSS vulnerability. The issue has been assigned a severity rating of High according to the CVSS scoring system (Jenkins Advisory).

The vulnerability allows attackers who can provide report files to the 'Publish Android Lint results' post-build step to execute arbitrary JavaScript code in the context of other users' browsers who view the affected tooltips (Jenkins Advisory).

The vulnerability is exploitable by attackers who have the ability to provide report files to the plugin's post-build step. This typically requires access to modify build artifacts or job configurations (Jenkins Advisory).

As of the advisory's publication date, no fix was available for this vulnerability. Users of the Android Lint Plugin version 2.6 and earlier should assess their risk and consider restricting access to the plugin's post-build step functionality (Jenkins Advisory).