Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2025-64134

Jenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prevent XML external entity (XXE) attacks.

VectorNETWORK

PublishedOct 29, 2025, 14:15

Published Byjenkinsci-cert@googlegroups.com

Base Score

Score7.1

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

org.jenkins-ci.plugins:jdepend(Maven)0N/AN/A

References

https://www.jenkins.io/security/advisory/2025-10-29/#SECURITY-2936
http://www.openwall.com/lists/oss-security/2025/10/29/2

Weakness Type

CWE-611

CVSS Metrics

Base Score

7.1

Vector String

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Base SeverityHigh

Version

3.1

Attack Vector (AV)

NETWORK