CVE-2019-1003028: SSRF vulnerability due to missing permission check in Jenkins JMS Messaging Plugin

The vulnerability stems from form validation methods handling JMS broker URLs without proper permission checks. Both classes mentioned in the advisory (SSLCertificateAuthenticationMethod and UsernameAuthenticationMethod) would contain doCheckBrokerUrl methods that process user input. The advisory explicitly states these were modified to add permission checks and POST requirements, confirming they were the vulnerable entry points. These methods would appear in stack traces when attackers trigger SSRF by submitting malicious broker URLs.