CVE-2022-43413: Jenkins Job Import

Medium severity, CVSS 4.3. EPSS: 0.6% chance of exploitation in the next 30 days.

Jenkins Job Import Plugin 3.5 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

Affected products

• Jenkins Job Import: before 3.6 (fixed in 3.6)

Published 2022-10-19. Last modified 2026-06-17.