Collection element type check bypass vulnerability

Jenkins uses XStream for serialization and deserialization of configuration and build data. The ability to provide XML documents to XStream is exposed to users who hold the respective /Configure permission, e.g., the item POST config.xml API is available with Item/Configure permission. XStream by...