CVE-2025-53670: Jenkins Nouvola DiveCloud Plugin Vulnerability Exposes Unencrypted Credentials
Summary
CVE-2025-53670: Jenkins Nouvola DiveCloud Plugin vulnerability stores unencrypted credentials. Affects org.jenkins-ci.plugins:nouvola-divecloud versions < 1.08. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Nouvola DiveCloud Plugin is designed to integrate Jenkins with the DiveCloud service, allowing users to manage their cloud resources directly from Jenkins. This plugin facilitates the automation of deployment processes and enhances the CI/CD pipeline. However, it has a critical security flaw that compromises sensitive information.
Vulnerability Detail
The vulnerability in the Jenkins Nouvola DiveCloud Plugin arises from the insecure storage of API keys and encryption credentials. Specifically, versions 1.08 and earlier store these sensitive credentials in an unencrypted format within the job config.xml files on the Jenkins controller. This flaw can be exploited by users with Item/Extended Read permission or those who have access to the Jenkins controller's file system, potentially leading to unauthorized access to sensitive data and cloud resources.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can restrict access to the Jenkins controller file system and limit user permissions to prevent unauthorized access to the job config.xml files. Additionally, consider using environment variables or secure vaults to store sensitive credentials instead of leaving them in the job configuration.
Conclusion
The Jenkins Nouvola DiveCloud Plugin vulnerability (CVE-2025-53670) poses a significant risk by exposing unencrypted credentials. It is crucial for users to update to the patched version to safeguard sensitive information and maintain the integrity of their CI/CD processes.
See every vulnerability recorded for org.jenkins-ci.plugins:nouvola-divecloud →
FAQ
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
The vulnerability affects Jenkins Nouvola DiveCloud Plugin versions 1.08 and earlier.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If an immediate update is not possible, restrict access to the Jenkins controller file system and limit user permissions to mitigate the risk.
The potential consequences include unauthorized access to sensitive API keys and credentials, which could lead to exploitation of cloud resources and compromise of the Jenkins environment.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:nouvola-divecloud.
