Jdepend
Monthly
An XML external entity (XXE) injection flaw in the Jenkins JDepend Plugin 1.3.1 and earlier lets authenticated users who can influence the XML processed by the plugin - such as a JDepend report or Maven project input via job configuration - cause the Jenkins controller to resolve attacker-supplied external entities, potentially disclosing local files and enabling server-side request forgery. The weakness originates in the outdated JDepend Maven Plugin bundled with this niche, non-default plugin, which does not disable external entity resolution in its XML parser. Exploitation requires a valid Jenkins account with at least job configure or build-triggering rights (CVSS PR:L), so this is an authenticated issue rather than an unauthenticated remote compromise; no public exploit has been identified at the time of analysis and the EPSS score of 0.35% (27th percentile) indicates a low likelihood of exploitation, placing this well below genuinely urgent issues.
An XML external entity (XXE) injection flaw in the Jenkins JDepend Plugin 1.3.1 and earlier lets authenticated users who can influence the XML processed by the plugin - such as a JDepend report or Maven project input via job configuration - cause the Jenkins controller to resolve attacker-supplied external entities, potentially disclosing local files and enabling server-side request forgery. The weakness originates in the outdated JDepend Maven Plugin bundled with this niche, non-default plugin, which does not disable external entity resolution in its XML parser. Exploitation requires a valid Jenkins account with at least job configure or build-triggering rights (CVSS PR:L), so this is an authenticated issue rather than an unauthenticated remote compromise; no public exploit has been identified at the time of analysis and the EPSS score of 0.35% (27th percentile) indicates a low likelihood of exploitation, placing this well below genuinely urgent issues.