8.0
High
CVE-2024-54003 Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name, resulting in a stored cross-site…
Description
Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Create permission.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Jenkins Simple Queue Plugin 1.4 | earliest → 1.4.4 | No fix stated |
| jenkins_simple_queue_plugin 1.4 | earliest → 1.4.4 | No fix stated |
References
- Jenkins Security Advisory 2024-11-27 www.jenkins.io
Timeline
- Published
- Last modified