[io.jenkins.plugins:perfecto] Missing permission check in Perfecto Plugin

Perfecto Plugin 1.17 and earlier does not perform a permission check in a method implementing a connection test.

This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL using attacker-specified username and password.

Perfecto Plugin 1.18 requires Overall/Administer permission to perform a connection test.

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-2260
• https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1979
• http://www.openwall.com/lists/oss-security/2020/09/16/3
• https://github.com/advisories/GHSA-3h2q-m63q-9cf6