Jenkins JDepend Plugin XML External Entity Vulnerability

A XML external entity (XXE) vulnerability exists in the JDepend Plugin for Jenkins, specifically in versions through 1.3.1. The plugin includes an outdated version of the JDepend Maven Plugin, which does not properly configure its XML parser to mitigate XXE attacks. This oversight allows attackers to craft input files for the 'Report JDepend' step that, when processed by Jenkins, could extract sensitive information from the Jenkins controller or exploit server-side request forgery.

Impact

Exploitation of this vulnerability could lead to unauthorized access to secrets stored in Jenkins or the execution of server-side request forgery attacks.