GHSA-5w52-96jj-fv59

Jenkins Cadence vManager Plugin Vulnerable to Cross-Site Request Forgery

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-47886

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:vmanager-plugin	< 4.0.1-288.v8804b_ea_a_cb_7f	4.0.1-288.v8804b_ea_a_cb_7f

Details

As written in the advisory (Markdown source, shown as plain text).

A cross-site request forgery (CSRF) vulnerability in Jenkins Cadence vManager Plugin 4.0.1-286.v9e25a_740b_a_48 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified username and password.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-47886 advisory
https://github.com/jenkinsci/vmanager-plugin/pull/25 web
https://github.com/jenkinsci/vmanager-plugin package
https://github.com/jenkinsci/vmanager-plugin/releases/tag/4.0.1-288.v8804b_ea_a_cb_7f web
https://www.jenkins.io/security/advisory/2025-05-14/#SECURITY-3548 web