Jenkins Cadence vManager Plugin Vulnerable to Cross-Site Request Forgery

Description

References

• nvd.nist.gov/vuln/detail/CVE-2025-47886 · ADVISORY
• jenkinsci/vmanager-plugin#25 · WEB
• jenkinsci/vmanager-plugin · PACKAGE
• jenkinsci/vmanager-plugin release 4.0.1-288.v8804b_ea_a_cb_7f · WEB
• jenkins.io/security/advisory/2025-05-14 · WEB

More vulnerabilities in org.jenkins-ci.plugins:vmanager-plugin

• CVE-2025-47887MEDIUM 4.3Missing permission checks in Jenkins Cadence vManager Plugin 4.0.1-286.v9e25a_740b_a_48 and earlier allows attackers with Overall/Read permi…
• CVE-2025-31724MEDIUM 4.3Jenkins Cadence vManager Plugin 4.0.0-282.v5096a_c2db_275 and earlier stores Verisium Manager vAPI keys unencrypted in job config.xml files …
• CVE-2020-2243MEDIUM 5.4Jenkins Cadence vManager Plugin 3.0.4 and earlier does not escape build descriptions in tooltips, resulting in a stored cross-site scripting…
• CVE-2019-10446HIGH 8.2Jenkins Cadence vManager Plugin 2.7.0 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM.