Back to feed
EUVD-2025-20844 · Published Jul 9, 2025
Jenkins Nouvola DiveCloud Plugin vulnerability stores unencrypted credentials Jenkins Nouvola DiveCloud Plugin 1.08 and earlier stores DiveCloud API Keys and Credentials Encryption Keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.
Technologies
Jenkins Nouvola Divecloud
Weaknesses
CWE-312
CVSS scores
- v3.14.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
MITRE ATT&CK
InferredWhere this vulnerability fits in an attack
Initial Access Credential Access Collection
References
Potentially impacted assets
See if this affects your attack surface
