{"id":"CVE-2025-31723","published":"2025-04-02T14:59:51Z","modified":"2025-04-02T16:59:30Z","title":"A cross-site request forgery (CSRF) vulnerability in Jenkins Simple Queue Plugin 1.4.6 and earlier allows attackers to…","vendor":"Jenkins","product":"Jenkins Simple Queue Plugin","tier":"tail","description":{"text":"A cross-site request forgery (CSRF) vulnerability in Jenkins Simple Queue Plugin 1.4.6 and earlier allows attackers to change and reset the build queue order.","provenance":"source","from":"CVE.org"},"cvss":{"score":4.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.00279,"percentile":0.20305,"provenance":"source"},"cwes":[{"id":"CWE-352","name":"Cross-Site Request Forgery"}],"references":[{"url":"https://www.jenkins.io/security/advisory/2025-04-02/#SECURITY-3469","tags":["vendor-advisory"]}],"priority":{"score":7.1,"factors":[{"name":"EPSS percentile","points":4.06},{"name":"CVSS severity","points":3.01}]},"vendorSlug":"jenkins","affectedVersions":[{"vendor":"Jenkins Project","product":"Jenkins Simple Queue Plugin","versions":["<= 1.4.6"]}],"affected":[{"ecosystem":"Maven","package":"io.jenkins.plugins:simple-queue","vulnerableRanges":["<1.4.7"],"patched":["1.4.7"],"from":["GHSA-hcfh-qjcp-34q9"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-9528","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2024-54003","published":"2024-11-27","fixed":"1.4.5","kev":false,"link":{"from":"CVE-2024-54003","to":"CVE-2025-31723","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:io.jenkins.plugins:simple-queue","fromFixed":"1.4.5","toFixed":"1.4.7","daysApart":126}]}},{"cve":"CVE-2025-31723","published":"2025-04-02","fixed":"1.4.7","kev":false}],"package":"Maven:io.jenkins.plugins:simple-queue"}}