CVE-2025-47887 Jenkins Cadence vManager Plugin is Missing Permission Checks

Medium 4.3 Published 14 May 2025 Updated 15 May 2025

Attackers with read access can bypass permission checks to connect to arbitrary URLs using provided credentials, potentially exposing sensitive data.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2025-47887?

CVE-2025-47887 is a medium-severity missing authorization vulnerability in Jenkins Cadence vManager Plugin, published on 14 May 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Missing permission checks in Jenkins Cadence vManager Plugin 4.0.1-286.v9e25a_740b_a_48 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.

Weakness: CWE-862

Which versions are affected by CVE-2025-47887?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:vmanager-plugin. It affects 1 product.

Package	Affected	Fixed in
`org.jenkins-ci.plugins:vmanager-plugin` Maven	All versions	`4.0.1-288.v8804b_ea_a_cb_7f`
`org.jenkins-ci.plugins:vmanager-plugin` Maven	All versions	`4.0.1-288.v8804b_ea_a_cb_7f`

Products include Jenkins Cadence Vmanager.

How do I fix CVE-2025-47887?

Upgrade org.jenkins-ci.plugins:vmanager-plugin to 4.0.1-288.v8804b_ea_a_cb_7f or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-47887 being exploited?

There is no known exploitation of CVE-2025-47887 in the wild and no public exploit code.

Sources

Also known as GHSA-rf73-97j8-9vqh.