CVE-2025-47886 Jenkins Cadence vManager Plugin Vulnerable to Cross-Site Request Forgery
Attackers can force users to connect to malicious URLs with attacker-controlled credentials via CSRF in the Jenkins Cadence vManager Plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-47886?
CVE-2025-47886 is a medium-severity vulnerability in Jenkins Cadence vManager Plugin, published on 14 May 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A cross-site request forgery (CSRF) vulnerability in Jenkins Cadence vManager Plugin 4.0.1-286.v9e25a_740b_a_48 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified username and password.
Weakness: CWE-352
Which versions are affected by CVE-2025-47886?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:vmanager-plugin. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:vmanager-plugin Maven | All versions | 4.0.1-288.v8804b_ea_a_cb_7f |
org.jenkins-ci.plugins:vmanager-plugin Maven | All versions | 4.0.1-288.v8804b_ea_a_cb_7f |
Products include Jenkins Cadence Vmanager.
How do I fix CVE-2025-47886?
Upgrade org.jenkins-ci.plugins:vmanager-plugin to 4.0.1-288.v8804b_ea_a_cb_7f or later.
Is CVE-2025-47886 being exploited?
There is no known exploitation of CVE-2025-47886 in the wild and no public exploit code.
Other vulnerabilities in Jenkins Cadence vManager Plugin
- CVE-2019-10446 Jenkins Cadence vManager Plugin disables SSL/TLS and hostname verification
- CVE-2020-2243 Stored XSS vulnerability in Jenkins Cadence vManager Plugin
- CVE-2025-47887 Jenkins Cadence vManager Plugin is Missing Permission Checks
- CVE-2025-31724 Jenkins Cadence vManager Plugin Stores Verisium Manager vAPI keys Unencrypted
Sources
Also known as GHSA-5w52-96jj-fv59.