GitHub Advisoryadvisory · Maven

GHSA-45hr-8gq6-7f7f Jenkins Nouvola DiveCloud Plugin vulnerability stores unencrypted credentials

MEDIUM Published 2025-07-09 Modified 2025-11-05 Official page ↗
Aliases
CVE-2025-53670
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:nouvola-divecloud
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-312
Reviewed
2025-07-09

Affected packages

• Maven org.jenkins-ci.plugins:nouvola-divecloud: <= 1.08 (no fix yet)

Description

Jenkins Nouvola DiveCloud Plugin 1.08 and earlier stores DiveCloud API Keys and Credentials Encryption Keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Related

Alias · CVE (1)

  • CVE-2025-53670 Jenkins Nouvola DiveCloud Plugin 1.08 and earlier stores DiveCloud API Keys and Credentials Encryption Keys unencrypted in job config.xml… vulnerability

Weakness · CWE (1)

  • CWE-312 Cleartext Storage of Sensitive Information weakness

References