CVE-2021-21620: Cross-Site Request Forgery in the Jenkins Claim plugin

The vulnerability stems from an HTTP endpoint handling claim assignments not requiring POST requests. Jenkins plugins typically implement form handlers via Stapler actions, where state-changing operations should use POST with CSRF protection. The advisory explicitly states the fix required POST enforcement, indicating the original handler lacked this protection. The most logical candidate is the claim assignment handler method in the core claim processing class, which would have been modified to add @RequirePOST annotation or similar protection in the patched version.