Jenkins Simple Queue Plugin has stored cross-site scripting (XSS) vulnerability

ALTO 8.0CVE-2024-54003 · GHSA-4gwv-fpmg-cmv2 · Published 27/11/2024 · updated 17/06/2026

In breve

CVE-2024-54003 è una vulnerabilità ALTO (CVSS 8.0) che riguarda io.jenkins.plugins:simple-queue, simple queue (jenkins).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 80.1%, superiore al 99.6% delle vulnerabilità.
Correzione: aggiornare a 1.4.5 o successiva.

Package	Affected versions	Patched versions
io.jenkins.plugins:simple-queue Maven	`< 1.4.5`	`1.4.5`
simple queue jenkins	`≤ 1.4.4`	No fix yet

Description

Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Create permission.

Simple Queue Plugin 1.4.5 escapes the view name.

NVD description

Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Create permission.

References

nvd.nist.gov/vuln/detail/CVE-2024-54003 · ADVISORY
jenkins.io/security/advisory/2024-11-27 · WEB

Altre vulnerabilità di io.jenkins.plugins:simple-queue

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free