CVE-2025-64134

Summary

Jenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prevent XML external entity (XXE) attacks.

Affected Software

Weaknesses

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: total

CVE Program Container

Additional References

• http://www.openwall.com/lists/oss-security/2025/10/29/2

References

• https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-2936

• ←Previous
• Next→