CVE-2020-2265: 
Java vulnerability analysis and mitigation

CVE-2020-2265 is a stored cross-site scripting (XSS) vulnerability affecting the Coverage/Complexity Scatter Plot Plugin for Jenkins. The vulnerability was discovered in version 1.1.1 and earlier versions of the plugin and was publicly disclosed on September 16, 2020. The vulnerability affects the Jenkins automation server's plugin system, specifically the covcomplplot plugin (Jenkins Advisory).

The vulnerability exists because the Coverage/Complexity Scatter Plot Plugin fails to properly escape method information in tooltips. This security flaw has been assigned a severity rating of High according to the CVSS scoring system. The vulnerability can be exploited through the 'Publish Coverage / Complexity Scatter Plot' post-build step functionality (Jenkins Advisory).

The vulnerability allows attackers who can provide report files to the 'Publish Coverage / Complexity Scatter Plot' post-build step to execute stored cross-site scripting (XSS) attacks. This could potentially lead to unauthorized access to sensitive information or manipulation of the Jenkins interface for other users (Jenkins Advisory).

The vulnerability is exploitable by attackers who have the ability to provide report files to the 'Publish Coverage / Complexity Scatter Plot' post-build step in Jenkins. The attack vector requires the attacker to have specific permissions within the Jenkins environment (Jenkins Advisory).

As of the advisory's publication date on September 16, 2020, there was no fix available for this vulnerability. Users of the Coverage/Complexity Scatter Plot Plugin should monitor for updates and consider implementing additional security controls to restrict access to the affected functionality (Jenkins Advisory).