CVE-2025-47886

Vulnerability

Overview

A cross-site request forgery (CSRF) vulnerability exists in the Jenkins Cadence vManager Plugin versions 4.0.1-286.v9e25a_740b_a_48 and earlier. The plugin fails to validate the origin of HTTP requests, allowing an attacker to craft a malicious page that, when visited by an authenticated Jenkins user, triggers a request to the plugin's endpoint. This causes Jenkins to connect to an attacker-specified URL using attacker-specified username and password [1][3][4].

Exploitation

Prerequisites

Exploitation requires tricking a Jenkins user with appropriate permissions (e.g., job configuration) into clicking a link or visiting a malicious page. No additional authentication is needed for the attacker, as the plugin does not enforce CSRF tokens or origin checks on the vulnerable endpoint [4].

Impact

An attacker can force Jenkins to connect to any external URL with arbitrary credentials, potentially exfiltrating sensitive data, performing actions on external systems, or leveraging Jenkins as a proxy for further attacks. This could lead to credential theft or unauthorized access to external services [4].

Mitigation

The vulnerability is fixed in Cadence vManager Plugin version 4.0.2 (or later), as addressed in pull request #25 [2]. Users should upgrade immediately. No workaround is available [2][4].