Jenkins Simple Queue Plugin has stored cross-site scripting (XSS) vulnerability

HIGH 8.0CVE-2024-54003 · GHSA-4gwv-fpmg-cmv2 · Published 27/11/2024 · updated 17/06/2026

Package	Affected versions	Patched versions
io.jenkins.plugins:simple-queue Maven	`< 1.4.5`	`1.4.5`
simple queue jenkins	`≤ 1.4.4`	No fix yet

Description

Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Create permission.

Simple Queue Plugin 1.4.5 escapes the view name.

NVD description

Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Create permission.

References

nvd.nist.gov/vuln/detail/CVE-2024-54003 · ADVISORY
jenkins.io/security/advisory/2024-11-27 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free