CVE-2025-47887 json
Jenkins Cadence vManager Plugin is Missing Permission Checks
published 2025-05-14 17 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-14883 , GHSA-rf73-97j8-9vqh
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 26%
- public exploits
- 0
- none known
Summary
Missing permission checks in Jenkins Cadence vManager Plugin 4.0.1-286.v9e25a_740b_a_48 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.
Patch / fix
- maven org.jenkins-ci.plugins:vmanager-plugin 4.0.1-288.v8804b_ea_a_cb_7f
- jenkins cadence_vmanager 4.0.1-288.v8804b_ea_a_cb_7f
- org.jenkins-ci.plugins vmanager-plugin 4.0.1-288.v8804b_ea_a_cb_7f
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 17 mo ago
Exploit prediction
0.33% chance of exploitation in the next 30 days, higher than 26% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
| GitHub | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins:vmanager-plugin | <4.0.1-288.v8804b_ea_a_cb_7f |
4.0.1-288.v8804b_ea_a_cb_7f |
Affected products
- Jenkins Project Jenkins Cadence vManager Plugin
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
-
github.com
/jenkinsci/vmanager-plugin/pull/25
web
-
jenkins.io
/security/advisory/2025-05-14/#SECURITY-3548
vendor-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2025-47887
advisory
-
github.com
/jenkinsci/vmanager-plugin
package
-
github.com
/jenkinsci/vmanager-plugin/releases/tag/4.0.1-288.v8804b_ea_a_cb_7f
web
Sources
- CVE List CVE-2025-47887
- GitHub Advisory GHSA-rf73-97j8-9vqh
- NVD CVE-2025-47887
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.