CVE-2024-54003

Jenkins Simple Queue Plugin 1.4.4 and earlier fails to escape the view name when rendering pages, allowing a stored cross-site scripting (XSS) vulnerability (CWE-79). An attacker who has View/Create permission on the Jenkins controller can create a view whose name contains malicious script, which is then executed in the browsers of other users who view affected pages. Successful exploitation could let the attacker run arbitrary scripts in victims' sessions, potentially reading sensitive data or performing actions as those users, which is why the flaw is rated high severity (CVSS 3.1: 8.0) despite requiring user interaction. Only Jenkins controllers with the Simple Queue Plugin version 1.4.4 or earlier installed are affected. No public proof-of-concept or confirmed in-the-wild exploitation is known, although EPSS estimates a 79.6% probability of exploitation within the next 30 days (100th percentile).

What to do: Update the Simple Queue Plugin to a release newer than 1.4.4 via the Jenkins plugin manager as soon as possible. Until then, limit View/Create permission to trusted users and review existing view names for embedded script content. Check whether the plugin is installed under Manage Jenkins > Plugins, since only installations of this plugin are affected.