CVE-2025-31723: Jenkins Simple Queue Plugin Cross-Site Request Forgery (CSRF)
4.3
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.04503%
CWE
Published
4/2/2025
Updated
4/2/2025
KEV Status
No
Technology
Java
Technical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.jenkins.plugins:simple-queue | maven | < 1.4.7 | 1.4.7 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability stems from missing POST method enforcement on state-changing endpoints. The patch adds @RequirePOST annotations to both doMove and doReset methods, indicating these were the vulnerable endpoints that accepted unsafe HTTP methods. These handler methods directly process the queue manipulation requests that were exploitable via CSRF. The Jelly template changes converting <a> tags to POST links support this by showing the UI triggers for these endpoints.