Description
Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with read access to obtain sensitive plugin installation information by leveraging missing permissions checks in unspecified XML/JSON API endpoints.
Remediation
References
Related Vulnerabilities
Oracle JRE CVE-2026-21925 Vulnerability (CVE-2026-21925)
Oracle JRE Incorrect Conversion between Numeric Types Vulnerability (CVE-2022-34169)
YOURLS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2011-3824)
WordPress Plugin Complianz-GDPR/CCPA Cookie Consent SQL Injection (6.3.3)
WordPress Plugin LearnPress-WordPress LMS PHP Object Injection (4.1.7.1)