CVE-2023-28675: Jenkins OctoPerf Load Testing Plugin missing permission check allows for unauthorized server connections

The vulnerability stems from HTTP endpoints handling Octoperf server connections without proper permission checks (CWE-284/CWE-862) and CSRF protections. Jenkins plugins typically implement such endpoints via servlet methods (e.g., doGet/doPost) in descriptor classes. The advisory explicitly states these endpoints allowed GET requests and lacked authorization checks. The functions above are standard candidates for connection testing logic in Jenkins plugins, and the fix in 4.5.3 (adding POST requirements and permissions) would directly target these methods. While the exact code isn't provided, the pattern matches Jenkins plugin architecture and the described vulnerability mechanics.