PT-2024-36010 · Jenkins · Jenkins Simple Queue Plugin+1

Swapna Nanda · Published 2024-11-27 · Updated 2025-10-03 · CVE-2024-54003

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Jenkins Simple Queue Plugin versions 1.4.4 and earlier

Description: The issue results in a stored cross-site scripting (XSS) vulnerability because the view name is not escaped. This vulnerability is exploitable by attackers with View/Create permission.

Recommendations: For Jenkins Simple Queue Plugin versions 1.4.4 and earlier, update to version 1.4.5 to prevent exploitation. As a temporary workaround, consider restricting the View/Create permission to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-54003

GHSA-4GWV-FPMG-CMV2

Affected Products

Jenkins

Jenkins Simple Queue Plugin

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-54003 · Security Note
• https://jenkins.io/security/advisory/2024-11-27/#SECURITY-3467 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4gwv-fpmg-cmv2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-54003 · Vendor Advisory
• https://twitter.com/the_yellow_fall/status/1861952033139605860 · Twitter Post
• https://twitter.com/Hossted_OSS/status/1866013532485001655 · Twitter Post
• https://t.me/cveNotify/137273 · Telegram Post
• https://twitter.com/CVEnew/status/1861825466497482848 · Twitter Post