Cyber Resilience

CVE-2025-64134

XXE in Jenkins Jdepend ≤ 1.3.1

XXE
Published
29 October 2025
Modified
05 November 2025
Patch / advisory
View advisory
CVSS Score v3.1 7.1
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
EPSS Score 0.0033 25th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2025-64134 is a high-severity Improper Restriction of XML External Entity Reference (CWE-611) vulnerability in Jenkins Jdepend. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 25th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A02:2025 Security Misconfiguration

EU & UK References

Vulnerability Data

Jenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prevent XML external entity (XXE) attacks.

CWE(s)
CWE-611

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
T1046 Network Service Discovery Discovery
Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation.
attack.mitre.org →
T1552.001 Credentials In Files Credential Access
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.
attack.mitre.org →
Why these techniques?

XXE vulnerability enables local file reads for data and secrets extraction (T1005, T1552.001) and SSRF for internal network service discovery (T1046).

CVEs Like This One

CVE-2023-24441Same vendor: Jenkins
CVE-2023-28685Same vendor: Jenkins
CVE-2023-28684Same vendor: Jenkins
CVE-2023-41933Same vendor: Jenkins
CVE-2023-41932Same vendor: Jenkins
CVE-2023-24430Same vendor: Jenkins
CVE-2023-24429Same vendor: Jenkins
CVE-2023-49656Same vendor: Jenkins
CVE-2023-37942Same vendor: Jenkins
CVE-2023-28682Same vendor: Jenkins

Affected Assets

jenkins
jdepend
≤ 1.3.1

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-2 Flaw Remediation
  • SI-7 Software, Firmware, and Information Integrity
Detect
Catch it (NIST detect / respond)
  • RA-5 Vulnerability Monitoring and Scanning
  • SI-7 Software, Firmware, and Information Integrity
Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V1.5.1
  • V15.3.2

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly requires timely remediation of known flaws such as the outdated JDepend Maven Plugin containing an unhardened XML parser.

RA-5 Vulnerability Monitoring and Scanning good match
detect

Mandates vulnerability scanning that would identify the vulnerable plugin version and CWE-611 exposure before exploitation.

SI-7 Software, Firmware, and Information Integrity partial match
preventdetect

Requires integrity verification and protection mechanisms that can detect or block use of software with unsafe XML parsing defaults.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-01 mostly match
prevents

Hardened XML parser configurations directly disable external entity resolution.

PR.PS-06 mostly match
prevents

Secure SDLC practices include input validation and safe XML parser configuration that prevent XXE.

ID.RA-01 partial match
prevents

Vulnerability scanning can discover XXE flaws but does not prevent their introduction in code.

PR.PS-02 partial match
prevents

Patching eliminates XXE-vulnerable parser versions but is only one aspect of software maintenance.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
detects

Security testing in development catches XXE via static analysis and dynamic XML fuzzing.

A.8.8 Management of technical vulnerabilities mostly match
detects

Vulnerability management identifies and patches XML libraries with unsafe default entity settings.

A.8.25 Secure development life cycle partial match
prevents

Secure development life cycle mandates input validation and entity handling that directly prevents XXE.

A.8.26 Application security requirements partial match
prevents

Application security requirements explicitly call for disabling external entity processing in XML parsers.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles include safe parser configuration that mitigates external entity risks.

A.8.28 Secure coding partial match
prevents

Secure coding standards require disabling DTDs and external entities in XML processing.

References