PT-2025-14514 · Jenkins · Jenkins Cadence Vmanager Plugin+1

Romuald Moisan + 1 · Published 2025-04-02 · Updated 2025-04-17 · CVE-2025-31724

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Cadence vManager Plugin versions 4.0.0-282.v5096a c2db 275 and earlier

Description The issue concerns the storage of Verisium Manager vAPI keys in an unencrypted form within job config.xml files on the Jenkins controller. These keys can be accessed by users who have Extended Read permission or direct access to the Jenkins controller file system.

Recommendations For versions 4.0.0-282.v5096a c2db 275 and earlier, consider restricting access to the Jenkins controller file system and limiting Extended Read permissions to minimize exposure of the unencrypted vAPI keys until a fix is available.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

CWE-256

Related Identifiers

BDU:2025-03791

CVE-2025-31724

GHSA-X9HJ-Q7XV-FV4V

Affected Products

Jenkins

Jenkins Cadence Vmanager Plugin

References · 12

• https://osv.dev/vulnerability/CVE-2025-31724 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-31724 · Security Note
• https://jenkins.io/security/advisory/2025-04-02/#SECURITY-3537 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-03791 · Security Note
• https://osv.dev/vulnerability/GHSA-x9hj-q7xv-fv4v · Vendor Advisory
• https://github.com/jenkinsci/vmanager-plugin · Note
• https://github.com/jenkinsci/vmanager-plugin/commit/9e25a740ba4837ef528c73b621259e840ef0db75 · Note
• https://t.me/cvetracker/20593 · Telegram Post
• https://jenkins.io/security/advisory/2025-04-02/#SECURITY-3513 · Note
• https://twitter.com/dailycve/status/1912899961219326118 · Twitter Post
• https://t.me/cvedetector/21883 · Telegram Post
• https://twitter.com/CVEnew/status/1907551233566716137 · Twitter Post