CVE-2025-53670

Vulnerability

Description

The Nouvola DiveCloud Plugin for Jenkins, in versions 1.08 and earlier, stores DiveCloud API Keys and Credentials Encryption Keys unencrypted in job config.xml files on the Jenkins controller [1][3]. This failure to protect sensitive credentials at rest violates security best practices and exposes the keys to unauthorized access.

Exploitation

To exploit this vulnerability, an attacker needs either the Item/Extended Read permission for a job on the Jenkins controller or direct access to the controller's file system [1][3]. The keys are stored in plaintext within the job configuration files, making them easily retrievable without additional decryption steps.

Impact

Successful exploitation allows an attacker to obtain DiveCloud API Keys and Credentials Encryption Keys [1][3]. With these credentials, an attacker could potentially access and manipulate DiveCloud services, leading to data breaches, service disruption, or further lateral movement within the environment.

Mitigation

According to the Jenkins Security Advisory 2025-07-09, the Nouvola DiveCloud Plugin has an unresolved security issue, meaning no patch is available at this time [1][2]. Users are advised to restrict Item/Extended Read permissions and limit file system access to trusted administrators only. Consider removing or replacing the plugin if possible.