CVE-2025-64134

Vulnerability

Description The Jenkins JDepend Plugin, versions 1.3.1 and earlier, bundles an outdated version of the JDepend Maven Plugin that fails to configure its XML parser to prevent XML External Entity (XXE) attacks [1]. This oversight allows an attacker to inject malicious XML content during the plugin's processing, leading to potential information disclosure or server-side request forgery [2].

Attack

Vector and Prerequisites Exploitation requires the ability to supply or manipulate XML input that is processed by the plugin, such as through a Jenkins job configuration or build artifact. No special privileges are needed beyond the ability to trigger builds that use the JDepend post-build action [1]. The attack can be performed remotely via crafted XML files.

Impact

A successful XXE attack can allow an attacker to read arbitrary files on the Jenkins controller file system, perform network reconnaissance, or initiate requests to internal systems from the Jenkins server [3]. This could lead to exposure of sensitive data or further compromise within the network.

Mitigation

Status As of the advisory publication date (2025-10-29), there is no patch available for the JDepend Plugin [1]. Users are advised to remove or disable the plugin if possible, or to restrict access to Jenkins job configuration to trusted users [2].