Jenkins AppSpider Plugin version 1.0.17 and earlier contain a missing permission check in a form‑validation method. The flaw allows a user possessing Overall/Read permission to trigger the plugin to open a connection to a URL supplied by the attacker. This results in unchecked outbound network traffic initiated from the Jenkins instance, which may expose the environment to unintended external communication. The weakness is classified as CWE‑269, improper privilege management.

Any Jenkins installation running AppSpider Plugin 1.0.17 or earlier is affected. The plugin is part of the Jenkins Project and is commonly integrated into pipelines. Versions later than 1.0.18 are not affected.

The CVSS score is 4.3, indicating moderate severity. EPSS data is not available, suggesting no widespread exploitation reports. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the Jenkins web interface; any user with Read access can submit the vulnerable form. Exploitation requires no elevated privileges beyond read. During exploitation, the plugin attempts to connect to an arbitrary URL, enabling potential malicious use of the Jenkins network connection.