CVE-2024-54003
Jenkins Simple Queue Plugin has stored cross-site scripting (XSS) vulnerability
Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Create permission.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Create permission.
- Record
CVE-2024-54003- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2024-3392
Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Create permission.
- Record
EUVD-2024-3392- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4gwv-fpmg-cmv2
Jenkins Simple Queue Plugin has stored cross-site scripting (XSS) vulnerability
Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Create permission.
Simple Queue Plugin 1.4.5 escapes the view name.
- Record
GHSA-4gwv-fpmg-cmv2- CVSS 4.0
- 8.6 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Create permission.
- Record
CVE-2024-54003- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-4gwv-fpmg-cmv2
Jenkins Simple Queue Plugin has stored cross-site scripting (XSS) vulnerability
Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Create permission.
Simple Queue Plugin 1.4.5 escapes the view name.
- Record
GHSA-4gwv-fpmg-cmv2- CVSS 4.0
- 8.6 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.jenkins.plugins:simple-queueMaven |
before 1.4.5 | 1.4.5 |
io.jenkins.plugins:simple-queueMaven |
before 1.4.5, plus listed versions 1.11.21.31.3.11.3.2 Show 6 moreShow less1.3.31.3.41.4.01.4.11.4.31.4.4 |
1.4.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-54003 is a high vulnerability (CVSS 8.0) in Jenkins Simple Queue, published November 27, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 81.2%, the 99th percentile. Fixed in io.jenkins.plugins:simple-queue 1.4.5.