Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2024-54003
CVE-2024-54003:
Java vulnerability analysis and mitigation
Overview
A high-severity stored cross-site scripting (XSS) vulnerability has been identified in Jenkins Simple Queue Plugin versions 1.4.4 and earlier, tracked as CVE-2024-54003. The vulnerability was discovered by Swapna Nanda from CloudBees, Inc. and was publicly disclosed on November 27, 2024. The vulnerability affects the Simple Queue Plugin component of Jenkins, a widely-used open-source automation server (Jenkins Advisory, NVD).
Technical details
The vulnerability stems from the plugin's failure to properly escape view names, leading to a stored cross-site scripting vulnerability. The issue has been assigned a CVSS v3.1 base score of 8.0 (High), with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. The vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation (NVD).
Impact
The vulnerability allows attackers with View/Create permission to inject malicious scripts that can be executed by other users accessing the affected Jenkins instance. This could potentially lead to data theft, session hijacking, or further system compromise (Security Online).
Mitigation and workarounds
The vulnerability has been patched in Simple Queue Plugin version 1.4.5, which properly escapes the view name. Users are strongly advised to update to this latest version immediately. All versions prior to 1.4.5 are considered vulnerable and should be updated (Jenkins Advisory, ASEC).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management