CSRF vulnerability and missing permission checks in alauda-devops-pipeline allows capturing credentials

alauda-devops-pipeline 2.3.2 and earlier does not perform permission checks on a method implementing form validation. This allows users with Overall/Read access to Jenkins to connect to Kubernetes-related paths on an attacker-specified web server using attacker-specified credentials IDs obtained...