The vulnerability in Jenkins Parameterized Remote Trigger Plugin versions up to 3.2.2 is due to a missing permission check. This flaw permits users who have Overall/Read permission, which is a relatively low privilege level, to enumerate the IDs of credentials stored within Jenkins. The enumeration of credential IDs could aid an attacker in further reconnaissance or targeted attacks against Jenkins credentials. No CVSS score or detailed exploit information is provided, and no official remediation or patch information is available at this time.

Attackers with Overall/Read permission can enumerate credential IDs stored in Jenkins. While this does not directly grant access to the credentials themselves, it exposes sensitive information that could facilitate further attacks or credential misuse. There is no indication of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and restrict Overall/Read permissions to trusted users only to limit exposure. Monitor Jenkins user permissions and audit access to credentials carefully.