{"id":"CVE-2024-54003","published":"2024-11-27T17:03:51Z","modified":"2024-11-27T19:12:14Z","title":"Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name, resulting in a stored cross-site…","vendor":"Jenkins Project","product":"Jenkins Simple Queue Plugin","tier":"core","eol":null,"affectedVersions":[{"vendor":"Jenkins Project","product":"Jenkins Simple Queue Plugin","versions":["<= 1.4.4"]}],"description":{"text":"Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Create permission.","provenance":"source","from":"CVE.org"},"summary":{"text":"The Jenkins Simple Queue Plugin, version 1.4.4 and earlier, does not escape view names, leaving a stored cross-site scripting flaw in the plugin's view handling. An attacker who holds View/Create permission can plant script in a view name, and it executes when a user interacts with that view, which requires user interaction and the attacker holding that permission.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:16:50Z"},"cvss":{"score":8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.801,"percentile":0.99615,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://www.jenkins.io/security/advisory/2024-11-27/#SECURITY-3467","tags":["vendor-advisory"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"io.jenkins.plugins:simple-queue","vulnerableRanges":["<1.4.5"],"patched":["1.4.5"],"from":["GHSA-4gwv-fpmg-cmv2"],"provenance":"source"}],"advisories":[{"id":"GHSA-4gwv-fpmg-cmv2","url":"https://github.com/advisories/GHSA-4gwv-fpmg-cmv2","severity":"HIGH","ecosystem":"Maven","package":"io.jenkins.plugins:simple-queue","vulnerableRanges":["<1.4.5"],"patched":["1.4.5"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2024-3392","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-3392","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2024-11-27","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2024-54003","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":25.5,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.92,"detail":"percentile 0.9961"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.6,"detail":"base score 8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2024-54003","published":"2024-11-27","fixed":"1.4.5","kev":false},{"cve":"CVE-2025-31723","published":"2025-04-02","fixed":"1.4.7","kev":false,"link":{"from":"CVE-2024-54003","to":"CVE-2025-31723","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:io.jenkins.plugins:simple-queue","fromFixed":"1.4.5","toFixed":"1.4.7","daysApart":126}]}}],"package":"Maven:io.jenkins.plugins:simple-queue"}}