Jenkins 2.550 and earlier, including LTS 2.541.1, allow users submitting a build to reference Run Parameter values that point to other builds the user does not have permission to see. An attacker possessing Item/Build and Item/Configure access can discover whether a particular job or build exists and, if the build exists, retrieve its display name. The flaw is a classic information exposure, identified as CWE-200, and an access control issue, identified as CWE-551. The disclosed information can aid an attacker in mapping the Jenkins environment, although it does not grant control over the system.

Jenkins Project’s Jenkins core, versions 2.550 or older and LTS 2.541.1 or older.

The CVSS score of 4.3 signals moderate severity. An EPSS score of <1% indicates that exploitation is currently considered unlikely, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access with Item/Build and Item/Configure permissions, so an attacker must already have some level of authority within the Jenkins environment. With those prerequisites, the attacker can glean internal job and build information by crafting a build request that references a protected build.