CVE-2025-53670: medium-severity vulnerability in Jenkins Nouvola DiveCloud Plugin
Published · Updated
Follow this CVE+ Monitor Jenkins Nouvola DiveCloud Plugin+ Monitor org.jenkins-ci.plugins:nouvola-divecloud
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 0.2%
Jenkins Nouvola DiveCloud Plugin 1.08 and earlier stores DiveCloud API Keys and Credentials Encryption Keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
Jenkins Project · Jenkins Nouvola DiveCloud PluginRelated CVEs — Jenkins Nouvola DiveCloud Plugin
In the same product, most dangerous first.