Jenkins Plugin Security Advisories: CVE-2025-47884 to 47889 (RCE, XSS, Auth Bypass)

Critical Vulnerability Information 1. OpenID Connect Provider Plugin CVE: CVE-2025-47884 Severity: Critical Affected Plugin: oidc-provider Description: In the OpenID Connect Provider Plugin, claim templates can be dynamically configured using environment variables. The default ID token template uses the environment variable, which may lead to environment variable override. 2. Health Advisor by CloudBees Plugin CVE: CVE-2025-47885 Severity: High Affected Plugin: cloudbees-jenkins-advisor Description: The Health Advisor plugin, in versions 374.v194b_d4f0c8c8 and earlier, does not escape responses from the Jenkins Health Advisor server, resulting in a stored XSS vulnerability. 3. Cadence vManager Plugin CVE: CVE-2025-47886 (CSRF), CVE-2025-47887 (Missing Permission Check) Severity: Medium Affected Plugin: vmanager-plugin Description: The Cadence vManager plugin, in versions 4.0.1-286.v9e25a_740b_a_48 and earlier, does not perform permission checks in form validation methods, allowing attackers with Overall/Read permissions to connect to specified URLs using specified usernames and passwords. 4. DingTalk Plugin CVE: CVE-2025-47888 Severity: Medium Affected Plugin: dingtalk-notifications Description: The DingTalk plugin, in versions 2.7.3 and earlier, unconditionally disables SSL/TLS certificate and hostname verification, introducing security risks. 5. WSO2 OAuth Plugin CVE: CVE-2025-47889 Severity: Critical Affected Plugin: wso2id-oauth Description: The WSO2 OAuth plugin, in versions 1.0 and earlier, accepts unvalidated authentication claims, allowing unauthenticated attackers to log in with arbitrary usernames and passwords. Affected Versions and Remediation Recommendations Cadence vManager Plugin: Upgrade to 4.0.1-288.v8804b_ea_a_cb_7f Health Advisor by CloudBees Plugin: Upgrade to 374.376.v3a_41a_a_142efe OpenID Connect Provider Plugin: Upgrade to 111.v29d614b_3617 DingTalk Plugin and WSO2 OAuth Plugin: No available patches currently.

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Plugin Security Advisories: CVE-2025-47884 to 47889 (RCE, XSS, Auth Bypass)