CVE-2020-2317: 
Java vulnerability analysis and mitigation

Jenkins FindBugs Plugin 5.0.0 and earlier contains a stored cross-site scripting (XSS) vulnerability (CVE-2020-2317) that was disclosed on November 4, 2020. The vulnerability affects the plugin's tooltip functionality where annotation messages are not properly escaped (Jenkins Advisory, NVD).

The vulnerability stems from improper escaping of annotation messages in tooltips within the FindBugs Plugin. The CVSS v3.1 base score is 5.4 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. This indicates that the vulnerability requires low attack complexity, requires low privileges, and user interaction for exploitation (NVD).

If successfully exploited, this vulnerability allows attackers who can provide report files to the Jenkins FindBugs Plugin's post build step to execute stored cross-site scripting attacks. This could potentially lead to unauthorized access to sensitive information or execution of malicious code in the context of other users' browsers (Jenkins Advisory).

The vulnerability is exploitable by attackers who have the ability to provide report files to the FindBugs Plugin's post build step. The attack requires low complexity and low privileges, though user interaction is required for successful exploitation (NVD).

As of the advisory's publication on November 4, 2020, no official fix was available for this vulnerability. Users of Jenkins FindBugs Plugin version 5.0.0 and earlier should monitor for updates and consider implementing additional security controls to restrict access to the plugin's functionality (Jenkins Advisory).