high8.0
CVE-2024-54003
Jenkins Simple Queue Plugin has stored cross-site scripting (XSS) vulnerability
Impact
Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Create permission. Simple Queue Plugin 1.4.5 escapes the view name.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | io.jenkins.plugins:simple-queue | < 1.4.5 | 1.4.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Simple Queue | through 1.4.4 |