The following links cover Jenkins exploits in more detail:
- Hacking Jenkins Part 2 - Abusing Meta Programming for Unauthenticated RCE: https://blog.orange.tw/2019/02/abusing-meta-programming-for-unauthenticated-rce.html
- Jenkins Security Advisory 2019-01-08: https://jenkins.io/security/advisory/2019-01-08/#SECURITY-1266
- Dependency management with Grape: http://docs.groovy-lang.org/latest/html/documentation/grape.html