[hudson.plugins:project-inheritance] Missing permission check in Jenkins Project Inheritance Plugin

Jenkins Project Inheritance Plugin 21.04.03 and earlier does not redact encrypted secrets in the ‘getConfigAsXML’ API URL when transmitting job config.xml data to users without Job/Configure.

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-2198
• https://jenkins.io/security/advisory/2020-06-03/#SECURITY-1582
• http://www.openwall.com/lists/oss-security/2020/06/03/3
• https://github.com/advisories/GHSA-w53q-r5cw-6vjh