Jenkins Android Lint vulnerabilities

2 CVEs affecting Jenkins Android Lint, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-2262, published 2020-09-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-1000055, published 2018-02-09. High severity, CVSS 8.3. EPSS: 0.8% chance of exploitation in the next 30 days. Jenkins Android Lint Plugin 2.5 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets…
CVE-2020-2262, published 2020-09-16. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. Jenkins Android Lint Plugin 2.6 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide…