CVE-2020-2323: Missing permission checks in Jenkins Chaos Monkey Plugin

The vulnerability stems from missing permission checks in HTTP endpoints related to the Chaos Monkey interface. In Jenkins plugin architecture, these endpoints are typically implemented as methods in action classes (like ChaosMonkeyAction) annotated with @WebMethod or mapped via routes. The advisory specifically mentions two capabilities granted to attackers: 1) accessing the Chaos Monkey page, and 2) viewing action history. These correspond to the index page handler doIndex() and history retrieval method getHistory(). The absence of checkPermission() calls or @RequireAdminister annotations in these methods would allow Overall/Read users to access admin-level functionality. The confidence is high as this pattern matches Jenkins' security model and the vulnerability description explicitly identifies these two exposed functionalities.