Jenkins Plugin Vulnerability: XML External Entity Issue in JDepend

CVE-2025-64134

What is CVE-2025-64134?

The JDepend Plugin for Jenkins, version 1.3.1 and earlier, has a security concern stemming from the inclusion of an outdated JDepend Maven Plugin. This version fails to properly configure its XML parser, leaving it susceptible to XML External Entity (XXE) attacks. Such vulnerabilities can lead to unauthorized access to sensitive data or server-side requests, compromising Jenkins environments. Users are advised to upgrade to patched versions and review security configurations to mitigate this risk.

References