Jenkins Simple Queue Plugin Cross-Site Request Forgery Vulnerability

A cross-site request forgery (CSRF) vulnerability exists in Jenkins Simple Queue Plugin versions through 1.4.6. This vulnerability allows attackers to manipulate and reset the order of builds in the queue. The issue arises because the plugin's HTTP endpoints do not require POST requests, leaving them open to CSRF attacks.

Impact

Exploitation of this vulnerability allows for unauthorized changes to the build queue order, potentially disrupting the intended workflow and build processes.

Remediation

Users of Jenkins Simple Queue Plugin should update to version 1.4.7, which addresses the CSRF vulnerability by requiring POST requests for the affected HTTP endpoints.