A vulnerability in Jenkins Script Security Plugin versions 1415.v9a_f9b_3a_c253d and earlier allows users with Overall/Administer permission to have classpath entries automatically approved when copying or updating item configurations via REST API or CLI. This can enable attackers who can define classpath entries to execute arbitrary code on the Jenkins controller JVM.