Credential theft via incorrect form-validation authorization

Incorrect authorization in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows remote authenticated users to capture credentials. The doValidateCredential form-validation method accepts an attacker-selected server URL and Jenkins credential ID, then authenticates to that server after checking Generic Create rather than an administrative permission. Generic Create access and a separately obtained credential ID are required; the outbound connection discloses the stored username and password to the attacker-controlled server.