CVE-2025-47887

Medium

Description

Missing permission checks in Jenkins Cadence vManager Plugin 4.0.1-286.v9e25a_740b_a_48 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.

SeverityMedium

CVSS4.3

Exploit probability—

Product

Jenkins Cadence Vmanager

PublishedMay 14, 2025

First seenMay 14, 2025

Weakness typeCWE-862Missing authorization

How to fix

Update

org.jenkins-ci.plugins:vmanager-plugin4.0.1-288.v8804b_ea_a_cb_7f or later

Vendor advisories

jenkins.io/security/advisory/2025-05-14/#SECURITY-3548

Affected products

Product	Affected versions	Fixed in
jenkins cadence_vmanager	v ≤ 4.0.1-286.v9e25a_740b_a_48	—
org.jenkins-ci.plugins:vmanager-pluginMaven	v < 4.0.1-288.v8804b_ea_a_cb_7f	4.0.1-288.v8804b_ea_a_cb_7f

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.