CVE-2024-54003: Jenkins Simple Queue Plugin stored XSS via unescaped view name

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityHigh CVSS impact with low-privilege authenticated access and a very high EPSS percentile, though exploitation requires victim interaction and no KEV listing exists.

What it is

Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name, producing a stored cross-site scripting flaw. An attacker with View/Create permission can plant script that executes in the browser of other users who view the affected content, which matters because Jenkins sessions often carry administrative reach.

Impact

An attacker gains script execution in the context of other users' Jenkins sessions, enabling session or credential theft and actions performed as the victim. The CVSS vector rates high confidentiality, integrity and availability impact.

Attack surface

Reachable over the network through the Jenkins web UI; the attacker needs View/Create permission (low privileges) and a victim must view the crafted content (user interaction required). No unauthenticated path is described.

Exploitation

Not listed in CISA KEV and no public exploit reference is provided; EPSS is high at 0.7962 (99.6th percentile), indicating elevated predicted exploitation likelihood despite the absence of confirmed in-the-wild activity.

What to do

• Upgrade Jenkins Simple Queue Plugin past 1.4.4 to the fixed release named in the vendor advisory SECURITY-3467.
• If immediate upgrade is not possible, restrict View/Create permission to trusted users only.
• Audit and remove unexpected or untrusted Jenkins views that may contain injected markup.
• Apply output encoding or a Content Security Policy at the Jenkins reverse proxy as a compensating control.

Detection

• Search Jenkins view names and configuration for HTML or script tags and other encoded payload patterns.
• Monitor Jenkins audit logs for View/Create permission grants and view creation by unusual accounts.
• Review HTTP logs for requests to view endpoints containing script-like parameters or payloads.
• Alert on anomalous authenticated sessions or actions following view access by privileged users.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.