Description
Jenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prevent XML external entity (XXE) attacks.
Affected products
jenkins: jdepend
References2
- www.jenkins.io/security/advisory/2025-10-29/#SECURITY-2936 Vendor Advisory
- www.openwall.com/lists/oss-security/2025/10/29/2 Mailing ListThird Party Advisory
Metrics
- CVSS 3.1
-
7.1
HIGH
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N - EPSS — exploit probability
- 0% percentile: 29 · as of 10 November 2026
- CWE
- CWE-611
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.