GHSA-4gwv-fpmg-cmv2

GitHub Security Advisory

Jenkins Simple Queue Plugin has stored cross-site scripting (XSS) vulnerability

✓ GitHub Reviewed HIGH Has CVE

Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Create permission.

Simple Queue Plugin 1.4.5 escapes the view name.

Maven io.jenkins.plugins:simple-queue

Affected versions: 0 (fixed in 1.4.5)

CVE-2024-54003

GHSA ID

GHSA-4gwv-fpmg-cmv2

Published

November 27, 2024 6:34 PM

Last Modified

November 27, 2024 7:49 PM

CVSS Score

7.5 /10

Primary Ecosystem

Maven

Primary Package

io.jenkins.plugins:simple-queue

GitHub Reviewed

✓ Yes

Last updated: August 24, 2025 6:28 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.