CVE-2020-2198: Missing permission check in Jenkins Project Inheritance Plugin

The vulnerability centers around the '/getConfigAsXML' endpoint which: 1) Lacks permission checks (should require Item/ExtendedRead/Configure but only checks Item/Read), and 2) Doesn't apply Jenkins' standard secret redaction mechanism. In Jenkins plugin architecture, API endpoints like this are typically implemented as do[MethodName] handlers in Action classes. The combination of missing permission validation and raw secret exposure strongly points to the endpoint handler function being vulnerable. The naming convention 'getConfigAsXML' matches the described vulnerable endpoint, and secret redaction would normally be handled in the XML serialization layer which this function appears to bypass.