GHSA-4v4v-92cx-x4f4

Jenkins Nouvola DiveCloud Plugin vulnerability does not mask keys on its job configuration form

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-53671

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:nouvola-divecloud	<= 1.08	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Nouvola DiveCloud Plugin 1.08 and earlier does not mask DiveCloud API Keys and Credentials Encryption Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-53671 advisory
https://github.com/jenkinsci/nouvola-divecloud-plugin package
https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3526 web
http://www.openwall.com/lists/oss-security/2025/07/09/4 web