A missing permission check in the Jenkins Parameterized Remote Trigger Plugin allows any user with Overall/Read permission to enumerate the IDs of credentials stored in Jenkins. Although the attacker cannot retrieve the actual secrets directly, having a list of credential IDs can facilitate further attacks such as targeted credential stuffing or reconnaissance, which may threaten confidentiality and potentially integrity of the system.

Jenkins Project’s Parameterized Remote Trigger Plugin versions 3.2.2 and earlier are affected. Any Jenkins installation that has this plugin installed is vulnerable to credential ID enumeration; the vulnerability could be exploited if the plugin is misused or exposed, which is inferred.

The vulnerability can be exploited by any account with Overall/Read privileges, which many environments grant to a wide user base. Attackers can call the plugin’s exposed endpoints to list credential IDs. The EPSS score of <1% indicates a very low probability of exploitation, and the issue is not listed in CISA’s KEV catalog, but the lack of an authorization check exposes the system to moderate risk if an attacker gains read access. The CVSS score of 4.3 categorizes it as moderate severity.