CVE-2020-2316: 
Java vulnerability analysis and mitigation

Jenkins Static Analysis Utilities Plugin version 1.96 and earlier contains a stored cross-site scripting (XSS) vulnerability identified as CVE-2020-2316. The vulnerability was discovered and disclosed on November 4, 2020, affecting the annotation message handling in tooltips. This security issue impacts installations using the Static Analysis Utilities Plugin up to and including version 1.96 (Jenkins Advisory).

The vulnerability stems from the plugin's failure to properly escape annotation messages in tooltips, creating a stored cross-site scripting (XSS) vulnerability. The severity of this vulnerability is rated as High according to the CVSS scoring system (Jenkins Advisory).

The vulnerability allows attackers with Job/Configure permission to execute stored cross-site scripting (XSS) attacks through maliciously crafted annotation messages in tooltips (Jenkins Advisory).

The vulnerability is exploitable by attackers who have Job/Configure permission in the Jenkins environment. This access level requirement makes the vulnerability somewhat limited in scope but still significant for authenticated users with the necessary permissions (Jenkins Advisory).

As of the advisory's publication date, no fix was available for this vulnerability. Users of the Static Analysis Utilities Plugin should monitor for updates and consider implementing additional security controls to limit access to Job/Configure permissions (Jenkins Advisory).