Understanding Jenkins unauthenticated RCE