What is GHSA-hcfh-qjcp-34q9?

GHSA-hcfh-qjcp-34q9 is a security advisory published by GitHub Security Advisories with Medium severity. Jenkins Simple Queue Plugin Cross-Site Request Forgery (CSRF)

Which CVE IDs does GHSA-hcfh-qjcp-34q9 cover?

GHSA-hcfh-qjcp-34q9 covers the following CVE IDs: CVE-2025-31723. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hcfh-qjcp-34q9?

GHSA-hcfh-qjcp-34q9 has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

Which products are affected by GHSA-hcfh-qjcp-34q9?

GHSA-hcfh-qjcp-34q9 affects 1 product, including: maven/io.jenkins.plugins:simple-queue:\u003c 1.4.7.

GHSA-hcfh-qjcp-34q9MediumCVSS 4.3

Jenkins Simple Queue Plugin Cross-Site Request Forgery (CSRF)

Vendor

GitHub Security Advisories

Published

April 2, 2025

Last Modified

April 2, 2025

🔗 CVE IDs covered (1)

CVE-2025-31723 →

📋 Description

Jenkins Simple Queue Plugin 1.4.6 and earlier does not require POST requests for multiple HTTP endpoints, resulting in cross-site request forgery (CSRF) vulnerabilities.

These vulnerabilities allow attackers to change and reset the build queue order.

Simple Queue Plugin 1.4.7 requires POST requests for the affected HTTP endpoints.

Administrators can enable equivalent HTTP endpoints without CSRF protection via the global configuration.

🎯 Affected products1

maven/io.jenkins.plugins:simple-queue:< 1.4.7

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2025-31723
https://www.jenkins.io/security/advisory/2025-04-02/#SECURITY-3469
https://github.com/jenkinsci/simple-queue-plugin/commit/c1094666dcd139830620d6d1c21b13f847601e74
https://github.com/advisories/GHSA-hcfh-qjcp-34q9