CVE-2025-31724 Jenkins Cadence vManager Plugin Stores Verisium Manager vAPI keys Unencrypted
Attackers with Extended Read permission or file system access can view unencrypted API keys stored in Jenkins job configurations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-31724?
CVE-2025-31724 is a medium-severity vulnerability in Jenkins Cadence vManager Plugin, published on 2 Apr 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Jenkins Cadence vManager Plugin 4.0.0-282.v5096a_c2db_275 and earlier stores Verisium Manager vAPI keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
Weakness: CWE-256
Which versions are affected by CVE-2025-31724?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:vmanager-plugin. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:vmanager-plugin Maven | All versions | 4.0.1 |
org.jenkins-ci.plugins:vmanager-plugin Maven | All versions | 4.0.1 |
Products include Jenkins Cadence Vmanager.
How do I fix CVE-2025-31724?
Upgrade org.jenkins-ci.plugins:vmanager-plugin to 4.0.1 or later.
Is CVE-2025-31724 being exploited?
There is no known exploitation of CVE-2025-31724 in the wild and no public exploit code.
Other vulnerabilities in Jenkins Cadence vManager Plugin
- CVE-2019-10446 Jenkins Cadence vManager Plugin disables SSL/TLS and hostname verification
- CVE-2020-2243 Stored XSS vulnerability in Jenkins Cadence vManager Plugin
- CVE-2025-47886 Jenkins Cadence vManager Plugin Vulnerable to Cross-Site Request Forgery
- CVE-2025-47887 Jenkins Cadence vManager Plugin is Missing Permission Checks
Sources
Also known as GHSA-x9hj-q7xv-fv4v.