4.3
CVE-2025-31724
- EPSS 0.13%
- Published 02.04.2025 15:15:59
- Last modified 17.04.2025 14:50:40
- Source jenkinsci-cert@googlegroups.co
- Teams watchlist Login
- Open Login
Jenkins Cadence vManager Plugin 4.0.0-282.v5096a_c2db_275 and earlier stores Verisium Manager vAPI keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
Data is provided by the National Vulnerability Database (NVD)
Jenkins ≫ Cadence Vmanager SwPlatformjenkins Version < 4.0.1-286.v9e25a_740b_a_48
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.13% | 0.327 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | 4.3 | 2.8 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
|
CWE-256 Plaintext Storage of a Password
Storing a password in plaintext may result in a system compromise.