A information exposure vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in AboutJenkins.java, ListPluginsCommand.java that allows users with Overall/Read access to enumerate all installed plugins.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1000192.json"