Jenkins Script Console Exploitation

A Jenkins controller exposed to the Internet may permit anonymous access to its controller Script Console if access control is disabled or authorization is misconfigured to grant anonymous users Overall/Administer. Jenkins assigns controller Script Console access to Overall/Administer, which allows arbitrary Groovy execution in the controller runtime. This is an access-control misconfiguration, not typical current setup-wizard behavior. The procedure tests only the controller console on an explicitly authorized non-production instance with a fixed-marker canary; it does not test separate agent consoles.