GitHub Advisoryadvisory · Maven

GHSA-4gwv-fpmg-cmv2 Jenkins Simple Queue Plugin has stored cross-site scripting (XSS) vulnerability

HIGH Published 2024-11-27 Modified 2024-11-27 Official page ↗
Aliases
CVE-2024-54003
Ecosystem
Maven
Packages
io.jenkins.plugins:simple-queue
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-79
Reviewed
2024-11-27

Affected packages

• Maven io.jenkins.plugins:simple-queue: < 1.4.5 → fixed in 1.4.5

Description

Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Create permission. Simple Queue Plugin 1.4.5 escapes the view name.

Related

Alias · CVE (1)

  • CVE-2024-54003 Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name, resulting in a stored cross-site scripting (XSS) vulnerability… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References