A vulnerability in Jenkins Script Security Plugin versions prior to 1402.v94c9ce464861 allows users with Overall/Read permission to enumerate pending and approved Script Security classpaths due to missing permission checks on an HTTP endpoint. This issue is fixed in version 1402.v94c9ce464861, which requires Overall/Administer permission for such enumeration.