Listen to this Post
How the CVE Works
The Jenkins Nouvola DiveCloud Plugin (v1.08 and earlier) stores sensitive DiveCloud API keys and credential encryption keys in plaintext within job `config.xml` files on the Jenkins controller. These files are accessible to users with Item/Extended Read permissions or those with filesystem access to the Jenkins controller. Attackers exploiting this flaw can extract these credentials, leading to unauthorized access to DiveCloud resources, data breaches, or further system compromise.
DailyCVE Form
Platform: Jenkins
Version: ≤1.08
Vulnerability: Credential Exposure
Severity: Critical
Date: 07/18/2025
Prediction: Patch by 08/15/2025
What Undercode Say
grep -r "DiveCloudAPIKey" /var/lib/jenkins/jobs/
<job><credentials><key>plaintext_key_here</key></credentials></job>
How Exploit
1. Gain Item/Extended Read access or filesystem access.
2. Locate `config.xml` in Jenkins job directories.
3. Extract plaintext API/encryption keys.
Protection from this CVE
1. Upgrade plugin when patched.
2. Restrict Item/Extended Read permissions.
3. Encrypt Jenkins controller filesystem.
Impact
- Unauthorized DiveCloud access.
- Data exfiltration.
- Privilege escalation.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
