CVE-2025-31724
- State
- Published
- Severity
- 4.3 Medium
- Published
- Apr 2, 2025
- Updated
- Apr 3, 2025
- Reserved
- Apr 1, 2025
Description
Jenkins Cadence vManager Plugin 4.0.0-282.v5096a_c2db_275 and earlier stores Verisium Manager vAPI keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | CISA-ADP |
Weaknesses
- CWE-256 Plaintext Storage of a Password
Affected Products
| Product | Versions |
|---|---|
Jenkins Cadence vManager PluginJenkins Project |
|
References
- Jenkins Security Advisory 2025-04-02vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.