Miggo Logo
Miggo Vulnerability Database
→
CVE-2025-31723

CVE-2025-31723: Jenkins Simple Queue Plugin Cross-Site Request Forgery (CSRF)

4.3

CVSS Score
3.1

Basic Information

CVE ID
CVE-2025-31723
GHSA ID
GHSA-hcfh-qjcp-34q9
EPSS Score
0.04503%
CWE
CWE-352
Published
4/2/2025
Updated
4/2/2025
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
io.jenkins.plugins:simple-queuemaven< 1.4.71.4.7

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from missing POST method enforcement on state-changing endpoints. The patch adds @RequirePOST annotations to both doMove and doReset methods, indicating these were the vulnerable endpoints that accepted unsafe HTTP methods. These handler methods directly process the queue manipulation requests that were exploitable via CSRF. The Jelly template changes converting <a> tags to POST links support this by showing the UI triggers for these endpoints.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

J*nkins Simpl* Qu*u* Plu*in *.*.* *n* **rli*r *o*s not r*quir* POST r*qu*sts *or multipl* *TTP *n*points, r*sultin* in *ross-sit* r*qu*st *or**ry (*SR*) vuln*r**iliti*s. T**s* vuln*r**iliti*s *llow *tt**k*rs to ***n** *n* r*s*t t** *uil* qu*u* or**r

Reasoning

T** vuln*r**ility st*ms *rom missin* POST m*t*o* *n*or**m*nt on st*t*-***n*in* *n*points. T** p*t** ***s @R*quir*POST *nnot*tions to *ot* *oMov* *n* *oR*s*t m*t*o*s, in*i**tin* t**s* w*r* t** vuln*r**l* *n*points t**t ****pt** uns*** *TTP m*t*o*s. T*