Jenkins Nouvola DiveCloud Plugin Plaintext Storage of API Keys Vulnerability

A vulnerability exists in the Jenkins Nouvola DiveCloud Plugin in versions through 1.08, where DiveCloud API Keys and Credentials Encryption Keys are stored unencrypted in job config.xml files on the Jenkins controller. This information can be accessed by users with Item/Extended Read permission or those who have access to the Jenkins controller file system.

Impact

The vulnerability allows for unauthorized access to sensitive API keys and encryption keys, which could be misused to access DiveCloud services or decrypt sensitive information.