Unencrypted API Key Exposure in Jenkins Cadence vManager Plugin
CVE-2025-31724

4.3MEDIUM

Key Information:

Vendor
Jenkins
Status
Jenkins Cadence Vmanager Plugin
Vendor
CVE Published:
2 April 2025

Summary

The Jenkins Cadence vManager Plugin prior to version 4.0.0-282.v5096a_c2db_275 has a serious vulnerability where Verisium Manager vAPI keys are stored unencrypted within the job config.xml files located on the Jenkins controller. This flaw allows users with Extended Read permission, or those with access to the Jenkins controller file system, to easily view the sensitive API keys. This exposure poses significant risks, especially in a multi-user environment where unauthorized users might exploit this access to gain control over API interactions.

Affected Version(s)

Jenkins Cadence vManager Plugin 0 <= 4.0.0-282.v5096a_c2db_275

References

https://www.jenkins.io/security/advisory/2025-04-02/#SECU...
vendor-advisory

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.