CVE-2025-53671: Jenkins Nouvola DiveCloud Plugin API Key Exposure Vulnerability
Summary
CVE-2025-53671: Jenkins Nouvola DiveCloud Plugin vulnerability does not mask keys on its job configuration form. Affects org.jenkins-ci.plugins:nouvola-divecloud versions < 1.08. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins Nouvola DiveCloud Plugin is an integration tool that allows Jenkins users to utilize the DiveCloud API for cloud-based testing services. This plugin facilitates seamless interaction with the DiveCloud platform, enabling users to manage their testing environments effectively. However, the plugin has a critical vulnerability that affects the security of sensitive information displayed in job configurations.
Vulnerability Detail
Jenkins Nouvola DiveCloud Plugin versions 1.08 and earlier do not adequately mask sensitive information such as DiveCloud API Keys and Credentials Encryption Keys on the job configuration form. This oversight increases the risk of unauthorized access, as attackers could potentially observe and capture these keys, leading to unauthorized actions within the DiveCloud environment. The vulnerability is classified under CWE-256, which pertains to the exposure of sensitive information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users should limit access to the job configuration forms to trusted personnel only, ensuring that sensitive information is not exposed to unauthorized users. Additionally, consider using environment variables to store sensitive keys instead of hardcoding them in the job configuration.
Conclusion
The Jenkins Nouvola DiveCloud Plugin has a significant vulnerability that exposes sensitive API keys in job configurations. Users are strongly advised to update to the latest version to mitigate this risk and protect their applications from potential unauthorized access.
See every vulnerability recorded for org.jenkins-ci.plugins:nouvola-divecloud →
FAQ
The vulnerability has a CVSS score of 4.3, indicating a moderate level of severity.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If exploited, attackers could gain access to sensitive API keys, leading to unauthorized access and control over the DiveCloud services.
Yes, a patch is available in version 1.09 of the Jenkins Nouvola DiveCloud Plugin.
CWE-256 refers to the exposure of sensitive information, which is the classification under which this vulnerability falls.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:nouvola-divecloud.
