GitHub Advisoryadvisory · Maven

GHSA-hcfh-qjcp-34q9 Jenkins Simple Queue Plugin Cross-Site Request Forgery (CSRF)

MEDIUM Published 2025-04-02 Modified 2025-04-02 Official page ↗
Aliases
CVE-2025-31723
Ecosystem
Maven
Packages
io.jenkins.plugins:simple-queue
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-352
Reviewed
2025-04-02

Affected packages

• Maven io.jenkins.plugins:simple-queue: < 1.4.7 → fixed in 1.4.7

Description

Jenkins Simple Queue Plugin 1.4.6 and earlier does not require POST requests for multiple HTTP endpoints, resulting in cross-site request forgery (CSRF) vulnerabilities. These vulnerabilities allow attackers to change and reset the build queue order. Simple Queue Plugin 1.4.7 requires POST requests for the affected HTTP endpoints. Administrators can enable equivalent HTTP endpoints without CSRF protection via the global configuration.

Related

Alias · CVE (1)

  • CVE-2025-31723 A cross-site request forgery (CSRF) vulnerability in Jenkins Simple Queue Plugin 1.4.6 and earlier allows attackers to change and reset the… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References