Jenkins Security Advisory: RCE and Info Disclosure in Core and Plugins (CVE-2025-31720 to 31728)

Critical Vulnerability Information Vulnerability Overview Announcement Date: 2025-04-02 Affected Jenkins Versions: - Jenkins (core) - AsakusaSatellite Plugin - Cadence vManager Plugin - monitor-remote-job Plugin - Simple Queue Plugin - Stack Hammer Plugin - Templating Engine Plugin Vulnerability Details 1. Missing permission check allows retrieving agent configurations - CVE: CVE-2025-31720, CVE-2025-31721 - Severity: Medium - Description: Jenkins versions 2.503 and earlier do not perform permission checks on HTTP endpoints, allowing attackers with Agent/Create permissions but without Agent/Extended Read permissions to copy agents and access their configurations. 2. Script Security sandbox bypass vulnerability through folder-scoped libraries in Templating Engine Plugin - CVE: CVE-2025-31722 - Severity: High - Description: In Templating Engine Plugin versions 2.5.3 and earlier, libraries defined within folders are not sandbox-protected, enabling attackers with Item/Configure permissions to execute arbitrary code. 3. CSRF vulnerability in Simple Queue Plugin - CVE: CVE-2025-31723 - Severity: Medium - Description: Simple Queue Plugin versions 1.4.6 and earlier do not require POST requests on multiple HTTP endpoints, leading to a Cross-Site Request Forgery (CSRF) vulnerability. 4. API keys stored in plain text by Cadence vManager Plugin - CVE: CVE-2025-31724 - Severity: Medium - Description: Cadence vManager Plugin versions up to and including 4.0.0-282.v5096a_c2db_275 store Verisium Manager vAPI keys in plain text. 5. Passwords stored in plain text by monitor-remote-job Plugin - CVE: CVE-2025-31725 - Severity: Medium - Description: monitor-remote-job Plugin versions up to and including 1.0 store passwords in plain text. 6. API keys stored in plain text by Stack Hammer Plugin - CVE: CVE-2025-31726 - Severity: Medium - Description: Stack Hammer Plugin versions up to and including 1.0.0 store Stack Hammer API keys in plain text. 7. API keys stored and displayed in plain text by AsakusaSatellite Plugin - CVE: CVE-2025-31727, CVE-2025-31728 - Severity: Medium - Description: AsakusaSatellite Plugin versions up to and including 0.1.1 store AsakusaSatellite API keys in plain text and display them unmasked in job configuration forms. Affected Versions Jenkins weekly: up to and including 2.503 Jenkins LTS: up to and including 2.492.2 AsakusaSatellite Plugin: up to and including 0.1.1 Cadence vManager Plugin: up to and including 4.0.0-282.v5096a_c2db_275 monitor-remote-job Plugin: up to and including 1.0 Simple Queue Plugin: up to and including 1.4.6 Stack Hammer Plugin: up to and including 1.0.0 Templating Engine Plugin: up to and including 2.5.3 Remediation Recommendations Upgrade to the following versions: - Jenkins weekly: 2.504 - Jenkins LTS: 2.492.3 - Cadence vManager Plugin: 4.0.1-286.v9e25a_740b_a_48 - Simple Queue Plugin: 1.4.7 - Templating Engine Plugin: 2.5.4

Goal Reached Thanks to every supporter — we hit 100%!

Jenkins Security Advisory: RCE and Info Disclosure in Core and Plugins (CVE-2025-31720 to 31728)