Jenkins Plugin Privilege Escalation and Info Disclosure Vulnerabilities (CVE-2025-31720-31725)

Critical Vulnerability Information Vulnerability Overview Announcement Date: 2025-04-02 Affected Jenkins Versions: - Jenkins (core) - AsakusaSatellite Plugin - Cadence vManager Plugin - monitor-remote-job Plugin - Simple Queue Plugin - Stack Hammer Plugin - Templating Engine Plugin Vulnerability Details 1. Missing permission check allows retrieving agent configurations - CVE: SECURITY-3512 / CVE-2025-31720 - Severity: Medium - Description: In Jenkins 2.503 and earlier versions, and LTS 2.492.2 and earlier, permission checks are not enforced on HTTP endpoints. This allows attackers with Agent/Create permissions but without Agent/Extended Read permissions to copy agents and access their configurations. 2. Missing permission check allows retrieving secrets from agent configurations - CVE: SECURITY-3513 / CVE-2025-31721 - Severity: Medium - Description: In Jenkins 2.503 and earlier versions, and LTS 2.492.2 and earlier, permission checks are not enforced on HTTP endpoints. This allows attackers with Agent/Create permissions but without Agent/Configure permissions to copy agents containing secrets, thereby accessing encrypted secrets in their configurations. This is a result of an incomplete fix for SECURITY-3495. 3. Script Security sandbox bypass vulnerability through folder-scoped libraries in Templating Engine Plugin - CVE: SECURITY-3505 / CVE-2025-31722 - Severity: High - Affected Plugin: templating-engine - Description: The Templating Engine Plugin allows libraries to be defined in global configuration and within folders used by pipelines. While libraries defined in global configuration can only be set by administrators and are thus trusted, libraries defined within folders can be configured by users with Item/Configure permissions. In Templating Engine Plugin versions 2.5.3 and earlier, libraries defined in folders are not sandboxed. This enables malicious users with Item/Configure permissions to execute arbitrary code, thereby bypassing the Script Security sandbox. 4. CSRF vulnerability in Simple Queue Plugin - CVE: SECURITY-3469 / CVE-2025-31723 - Severity: Medium - Affected Plugin: simple-queue - Description: Simple Queue Plugin versions 1.4.6 and earlier do not require POST requests for multiple HTTP endpoints, resulting in a Cross-Site Request Forgery (CSRF) vulnerability. These vulnerabilities allow attackers to alter and reset the build queue order. 5. API keys stored in plain text by Cadence vManager Plugin - CVE: SECURITY-3537 / CVE-2025-31724 - Severity: Medium - Affected Plugin: vmanager-plugin - Description: Cadence vManager Plugin versions 4.0.0-282.v5096a_c2db_275 and earlier store Verisium Manager vAPI keys in plain text within the job config.xml file on the Jenkins controller as part of their configuration. These API keys can be viewed by users with Item/Extended Read permissions or those with access to the Jenkins controller's filesystem. 6. Passwords stored in plain text by monitor-remote-job Plugin - CVE: SECURITY-3539 / CVE-2025-31725 - Severity: Medium - Affected Plugin: monitor-remote-job - Description: monitor-remote-job Plugin versions 1.0 and earlier store passwords in plain text within the job config.xml file on the Jenkins controller as part of their configuration. These passwords can be viewed by users with Item/Extended Read permissions or those with access to the Jenkins controller's filesystem. 7. API keys stored in plain text by Stack Hammer Plugin - CVE: SECURITY-3520 / CVE-2025-31726 - Severity: Medium - Affected Plugin: stackhammer - Description: Stack Hammer Plugin versions 1.0.0 and earlier store Stack Hammer API keys in plain text within the job config.xml file on the Jenkins controller as part of their configuration. These API keys can be viewed by users with Item/Extended Read permissions or those with access to the Jenkins controller's filesystem. 8. API keys stored and displayed in plain text by AsakusaSatellite Plugin - CVE: SECURITY-3523 / CVE-2025-31727 (storage), CVE-2025-31728 (masking) - Severity: Medium - Affected Plugin: asakusa-satellite-plugin - Description: AsakusaSatellite Plugin versions 0.1.1 and earlier store AsakusaSatellite API keys in plain text within the job config.xml file on the Jenkins controller as part of their configuration. These API keys can be viewed by users with Item/Extended Read permissions or those with access to the Jenkins controller's filesystem. Additionally, the job configuration form does not mask these API keys, increasing the risk of attackers observing and capturing them. Remediation Recommendations Upgrade Jenkins weekly to version 2.504. Upgrade Jenkins LTS to version 2.492.3. Upgrade Cadence vManager Plugin to version 4.0.1-286.v9e25a_740b_a_48. Upgrade Simple Queue Plugin to version 1.4.7. Upgrade Templating Engine Plugin to version 2.5.4.

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Plugin Privilege Escalation and Info Disclosure Vulnerabilities (CVE-2025-31720-31725)