GHSA-x9hj-q7xv-fv4v

Jenkins Cadence vManager Plugin Stores Verisium Manager vAPI keys Unencrypted

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-31724

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:vmanager-plugin	< 4.0.1	4.0.1

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Cadence vManager Plugin 4.0.0-282.v5096a_c2db_275 and earlier stores Verisium Manager vAPI keys unencrypted in job `config.xml` files on the Jenkins controller as part of its configuration. These API keys can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. Cadence vManager Plugin 4.0.1-286.v9e25a_740b_a_48 stores Verisium Manager vAPI keys encrypted once affected job configurations are saved again.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-31724 advisory
https://github.com/jenkinsci/vmanager-plugin/commit/9e25a740ba4837ef528c73b621259e840ef0db75 web
https://github.com/jenkinsci/vmanager-plugin package
https://www.jenkins.io/security/advisory/2025-04-02/#SECURITY-3537 web