Jenkins Nexus Task Runner Plugin Missing Permission Check Vulnerability

A vulnerability exists in the Jenkins Nexus Task Runner Plugin in versions through 0.9.2, allowing attackers with Overall/Read permission to connect to a specified URL using their own credentials. This exploitation takes place through an HTTP endpoint that lacks proper permission checks and does not require POST requests, creating a cross-site request forgery (CSRF) vulnerability.

Impact

Exploitation of this vulnerability could lead to unauthorized access to resources or actions on behalf of the user, potentially allowing for further exploitation or data access.