CVE-2025-31724: Medium severity cadence vmanager plugin vulnerability
Jenkins Cadence vManager Plugin 4.0.0-282.v5096ac2db275 and earlier stores Verisium Manager vAPI keys unencrypted in job config.xml files on the Jenkins controller as part of its configuration.
These API keys can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
Cadence vManager Plugin 4.0.1-286.v9e25a740ba48 stores Verisium Manager vAPI keys encrypted once affected job configurations are saved again.
Other sources
Jenkins Cadence vManager Plugin 4.0.0-282.v5096ac2db275 and earlier stores Verisium Manager vAPI keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-31724?
CVE-2025-31724 is considered a moderate severity vulnerability due to the exposure of sensitive vAPI keys.
How do I fix CVE-2025-31724?
To mitigate CVE-2025-31724, update the Jenkins Cadence vManager Plugin to version 4.0.0-283.vxxxx or later.
Who is affected by CVE-2025-31724?
CVE-2025-31724 affects users of the Jenkins Cadence vManager Plugin version 4.0.0-282.v5096a_c2db_275 and earlier.
What are the risks associated with CVE-2025-31724?
The risks of CVE-2025-31724 include unauthorized access to Verisium Manager vAPI keys by users with Extended Read permission on the Jenkins controller.
Where are the vulnerabilities stored in CVE-2025-31724?
In CVE-2025-31724, the Verisium Manager vAPI keys are stored unencrypted in job config.xml files on the Jenkins controller.