Jenkins Plugin Security Advisory: CVE-2025-47884 to 47889 (RCE/XSS/Privilege Escalation)

Critical Vulnerability Information 1. OpenID Connect Provider Plugin CVE: CVE-2025-47884 Severity: Critical Affected Plugin: openid-provider Description: In the OpenID Connect Provider Plugin, claim templates can be dynamically configured using environment variables. The default build ID token template uses the environment variable, which may lead to unauthorized access. 2. Health Advisor by CloudBees Plugin CVE: CVE-2025-47885 Severity: High Affected Plugin: cloudbees-jenkins-advisor Description: The Health Advisor plugin does not properly escape certain content when processing responses, leading to a stored XSS vulnerability. 3. Cadence vManager Plugin CVE: CVE-2025-47886 (CSRF), CVE-2025-47887 (Missing Permission Check) Severity: Medium Affected Plugin: vmanager-plugin Description: The plugin does not perform permission checks in form validation methods, and some validation methods do not require POST requests, resulting in CSRF and permission bypass vulnerabilities. 4. DingTalk Plugin CVE: CVE-2025-47888 Severity: Medium Affected Plugin: dingding-notifications Description: The plugin unconditionally disables SSL/TLS certificate verification, posing a risk to secure connections. 5. WSO2 Oauth Plugin CVE: CVE-2025-47889 Severity: Critical Affected Plugin: wso2id-oauth Description: The plugin does not validate authentication claims during the authentication process, allowing unauthorized users to log in with any username and password. Affected Versions and Remediation Recommendations Cadence vManager Plugin: Upgrade to version 4.0.1-288.v8804b_ea_a_cb_7f Health Advisor by CloudBees Plugin: Upgrade to version 374.376.v3a_41a_a_142efe OpenID Connect Provider Plugin: Upgrade to version 111.v29d614b_3617 DingTalk Plugin and WSO2 Oauth Plugin: No patched versions currently available.

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Plugin Security Advisory: CVE-2025-47884 to 47889 (RCE/XSS/Privilege Escalation)