Jenkins JDepend Plugin
CVE-2025-64134
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged Jenkins user
-
DeliverySubmit XML with external entity to JDepend parser
-
ExploitXML parser resolves external entity
-
ExecutionRead local files or trigger SSRF
-
ImpactExfiltrate sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A02:2025 - Security Misconfiguration
ASVS 5.0
V13 - Configuration XML external entity prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the Jenkins JDepend Plugin (1.3.1 or earlier) to be installed, and an attacker must have an authenticated account with sufficient permission (typically Job/Item configure or build-triggering rights, per CVSS PR:L) to cause the plugin to parse attacker-controlled XML such as a JDepend report or Maven project input. The limiting factors are: valid authentication to the Jenkins instance, permission to supply or influence the parsed XML, and the plugin actually being installed (a niche, non-default component). No end-user interaction (UI:N) and no non-default server configuration beyond having the plugin present are needed; the weakness is the bundled JDepend Maven Plugin's XML parser not disabling external entity resolution. |
| Impact | This is a moderate-severity, authenticated XXE flaw (CWE-611) that in practice ranks well below genuinely urgent issues. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, 7.1) indicates network reach and low attack complexity but requires existing privileges (PR:L) - consistent with Jenkins plugin XXE, which typically needs an authenticated user holding Job/Item configure permission to supply crafted XML. EPSS is low at 0.35% (27th percentile), the CVE is NOT in CISA KEV, and no POC is referenced in the provided sources, so all exploitation signals are concordant and point to low near-term real-world exploitation. No SSVC decision data was supplied. Net: a legitimate issue to patch on a normal maintenance cadence, but not an emergency - the privilege requirement and low EPSS argue against widespread opportunistic exploitation. One nuance to verify: the single-impact rating C:H/I:L reflects classic XXE file disclosure/SSRF, but exact exfiltration capability depends on the parser and error handling in the bundled JDepend Maven Plugin, which the advisory does not detail. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged authenticated Jenkins account with permission to configure or trigger builds supplies a crafted XML input (e.g., a JDepend report/project file) containing a malicious external entity. When the vulnerable JDepend Plugin parses it without XXE protections, the server resolves the entity, disclosing local files or making server-side requests. No public exploit is referenced in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
An XML external entity (XXE) injection flaw in the Jenkins JDepend Plugin 1.3.1 and earlier lets authenticated users who can influence the XML processed by the plugin - such as a JDepend report or Maven project input via job configuration - cause the Jenkins controller to resolve attacker-supplied external entities, potentially disclosing local files and enabling server-side request forgery. The weakness originates in the outdated JDepend Maven Plugin bundled with this niche, non-default plugin, which does not disable external entity resolution in its XML parser. Exploitation requires a valid Jenkins account with at least job configure or build-triggering rights (CVSS PR:L), so this is an authenticated issue rather than an unauthenticated remote compromise; no public exploit has been identified at the time of analysis and the EPSS score of 0.35% (27th percentile) indicates a low likelihood of exploitation, placing this well below genuinely urgent issues.
RemediationAI
Patch status: Patch available per vendor advisory. The primary fix is to upgrade the Jenkins JDepend Plugin to the version designated in Jenkins Security Advisory 2025-10-29 (SECURITY-2936) at https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-2936, which updates the bundled JDepend Maven Plugin to a release whose XML parser disables external entity resolution; consult that advisory for the exact fixed version, since the specific release identifier is not enumerated in the available data. If the JDepend Plugin is not actively used, the cleanest mitigation is to uninstall it entirely, removing the vulnerable parsing path - the trade-off is loss of JDepend reporting for any jobs that reference it. Where the plugin must remain, restrict Jenkins authorization so that only trusted users hold Job/Configure (and build-triggering) permissions, since the exploit path requires an authenticated account able to supply or influence the parsed XML; this reduces the attack surface but does not eliminate the flaw for privileged insiders. Additional compensating controls include blocking outbound HTTP/SMB traffic from the Jenkins controller and tightening file-system permissions on the account running Jenkins - these limit XXE data exfiltration and SSRF impact but can interfere with legitimate plugin downloads and build tooling, so they should be scoped carefully. After patching, review job configurations and build records for crafted JDepend or Maven XML and monitor controller logs for anomalous external-entity resolution attempts.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in maven
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is CWE-611 (Improper Restriction of XML External Entity Reference). The Jenkins JDepend Plugin bundles an outdated copy of the JDepend Maven Plugin, whose underlying XML parser (the Maven/Plexus XML parsing stack, e.g. Xpp3Dom-based document building) is not configured with secure processing features such as disallow-doctype-decl, external-general-entities=false, or external-parameter-entities=false. When the plugin parses attacker-influenced XML - for example, a crafted JDepend report or Maven project descriptor containing a DOCTYPE with an ENTITY declaration - the parser follows the external reference. A file:// URI can read files accessible to the Jenkins controller process, while http:// or UNC/SSRF-style references can leak data out of band or probe internal services; impact on integrity is low (CVSS I:L) because the primary outcomes are disclosure and request forgery rather than arbitrary modification. The CPE string cpe:2.3:a:jenkins:jdepend:*:*:*:*:*:jenkins:*:* confirms that all versions of the Jenkins JDepend plugin up to and including 1.3.1 are in scope; the flaw lives in the vendored dependency rather than in Jenkins core, which limits exposure to instances that actually have this plugin installed. Because the vulnerable code path is only reachable when attacker-controlled XML is fed to the plugin, the assessed prerequisites are authentication plus permission to supply or influence that XML, not merely network reachability.
Know when Jdepend gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Authenticated low-privileged user must supply XML to the plugin (PR:L, AV:N, AC:L); XXE yields file/SSRF disclosure (C:H) with limited integrity impact (I:L) and no availability impact.
Primary rating from Vendor (googlegroups).
CVSS VectorVendor: googlegroups
DescriptionCVE.org
Jenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prevent XML external entity (XXE) attacks.
Executive ViewAI
The Jenkins JDepend Plugin, a niche reporting add-on present on some Jenkins controllers, contains a high-severity XML external entity flaw in versions 1.3.1 and earlier that allows any user holding a valid Jenkins account with job configuration or build-triggering rights to read files from the controller host and coerce it into making outbound network requests. This is an authenticated issue affecting a non-default plugin, so exposure is limited to organizations that have installed it and to insiders or compromised low-privilege accounts, but it can convert routine build permissions into disclosure of secrets stored on the Jenkins controller. Leadership should care because the controller is a high-value system that typically holds credentials for the entire software delivery pipeline.
No vendor-released patch identified at time of analysis. Interim mitigations: disable or uninstall the JDepend Plugin 1.3.1 and earlier on all Jenkins controllers; restrict job configure and build-triggering permissions to trusted administrators and review accounts holding them; enforce outbound egress filtering from the controller to limit server-side request forgery reach; minimize and rotate credentials stored on the controller; monitor controller logs for unexpected outbound requests or XML processing anomalies.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
XML External Entity (XXE) attacks exploit XML parsers that process Document Type Definitions (DTDs) without proper restrictions.
GitHub PoC
Exploit-DB