Description
Jenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prevent XML external entity (XXE) attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins Project | Jenkins JDepend Plugin | ≤ 1.3.1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.plugins:jdepend | <= 1.3.1 | — | GHSA-jfg6-4gx3-3v7w |
Advisories 1
- WID-SEC-2025-2443 Jenkins Plugins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 29, 2025
References
- Jenkins Security Advisory 2025-10-29 vendor-advisory