CVE-2025-64134: XEE
Published Oct 29, 2025
·Updated
Jenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prevent XML external entity (XXE) attacks.
Affected Software
3 affected components
Jenkins JDepend Plugin<=1.3.1
maven/org.jenkins-ci.plugins:jdepend<=1.3.1
Jenkins Jdepend Jenkins<=1.3.1
Event History
Oct 29, 2025
CVE Published
via MITRE·01:29 PM
Data Sourced
via MITRE·01:29 PM
Description
Data Sourced
via NVD·02:15 PM
DescriptionSeverityWeaknessAffected Software
Advisory Published
via GitHub·03:31 PM
Data Sourced
via GitHub·03:31 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-64134?
CVE-2025-64134 has a moderate severity level due to the potential for XML external entity (XXE) attacks.
2
How do I fix CVE-2025-64134?
To fix CVE-2025-64134, upgrade to JDepend Plugin version 1.3.2 or later.
3
What versions are affected by CVE-2025-64134?
CVE-2025-64134 affects Jenkins JDepend Plugin versions up to and including 1.3.1.
4
What type of attack does CVE-2025-64134 allow?
CVE-2025-64134 allows for XML external entity (XXE) attacks due to misconfigured XML parsing.
5
Is CVE-2025-64134 related to Jenkins?
Yes, CVE-2025-64134 specifically affects the Jenkins JDepend Plugin.