Jenkins Cadence vManager Plugin API Key Storage Vulnerability

A vulnerability exists in the Jenkins Cadence vManager Plugin versions through 4.0.0-282.v5096a_c2db_275, where Verisium Manager vAPI keys are stored unencrypted in job config.xml files on the Jenkins controller. This exposure allows users with Extended Read permission or access to the Jenkins controller file system to view these API keys.

Impact

The vulnerability allows unauthorized users to access sensitive API keys, which could potentially be misused or lead to further exploitation.

Remediation

Users of the Cadence vManager Plugin should update to version 4.0.1-286.v9e25a_740b_a_48, which encrypts the Verisium Manager vAPI keys when job configurations are saved.