PT-2025-44283 · Unknown+1 · Jdepend Maven Plugin+2

Published 2025-10-29 · Updated 2025-10-29 · CVE-2025-64134

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins JDepend Plugin versions 1.3.1 and earlier

Description The Jenkins JDepend Plugin uses an outdated version of the JDepend Maven Plugin that lacks proper configuration of its XML parser. This configuration deficiency can allow for XML external entity (XXE) attacks. An XXE attack can potentially allow an attacker to access sensitive information or execute arbitrary code.

Recommendations Update the Jenkins JDepend Plugin to a version newer than 1.3.1.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2025-64134

GHSA-JFG6-4GX3-3V7W

Affected Products

Jdepend Maven Plugin

Jenkins

Jenkins Jdepend Plugin

References · 8

• https://osv.dev/vulnerability/CVE-2025-64134 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jfg6-4gx3-3v7w · Vendor Advisory
• https://jenkins.io/security/advisory/2025-10-29/#SECURITY-2936 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64134 · Security Note
• https://github.com/jenkinsci/jdepend-plugin · Note
• https://t.me/CVEtracker/36056 · Telegram Post
• https://twitter.com/CVEnew/status/1983530927277170964 · Twitter Post
• http://openwall.com/lists/oss-security/2025/10/29/2 · Note