CVE-2025-64134

Jenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prevent XML external entity (XXE) attacks.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-2936	Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/10/29/2	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:jenkins:jdepend:*:*:*:*:*:jenkins:*:*

History

08 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Jenkins JDepend Plugin 1.3.1 y anteriores incluye una versión desactualizada de JDepend Maven Plugin que no configura su analizador XML para prevenir ataques de entidad externa XML (XXE).

Information

Published : 2025-10-29 14:15

Updated : 2026-10-08 11:10

NVD link : CVE-2025-64134

Mitre link : CVE-2025-64134

CVE.ORG link : CVE-2025-64134

JSON object : View

Products Affected

jenkins

jdepend

CWE

CWE-611

Improper Restriction of XML External Entity Reference

{"id": "CVE-2025-64134", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-64134", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-10-29T14:08:28.762874Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "jenkinsci-cert@googlegroups.com", "affectedData": [{"vendor": "Jenkins Project", "product": "Jenkins JDepend Plugin", "versions": [{"status": "affected", "version": "0", "versionType": "maven", "lessThanOrEqual": "1.3.1"}], "defaultStatus": "unknown"}]}], "published": "2025-10-29T14:15:57.613", "references": [{"url": "https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-2936", "tags": ["Vendor Advisory"], "source": "jenkinsci-cert@googlegroups.com"}, {"url": "http://www.openwall.com/lists/oss-security/2025/10/29/2", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "Jenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prevent XML external entity (XXE) attacks."}, {"lang": "es", "value": "Jenkins JDepend Plugin 1.3.1 y anteriores incluye una versi\u00f3n desactualizada de JDepend Maven Plugin que no configura su analizador XML para prevenir ataques de entidad externa XML (XXE)."}], "lastModified": "2026-10-08T11:10:00.250", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:jenkins:jdepend:*:*:*:*:*:jenkins:*:*", "vulnerable": true, "matchCriteriaId": "278758E7-6D4A-408B-B6C1-89097186AFAC", "versionEndIncluding": "1.3.1"}], "operator": "OR"}]}], "sourceIdentifier": "jenkinsci-cert@googlegroups.com"}