High severity · published Jul 26, 2023
CVE-2023-3442
Missing Authorization in Jenkins plug-in for ServiceNow DevOps
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
A missing authorization vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could cause the unwanted exposure of sensitive information. To address this issue, apply the 1.38.1 version of the Jenkins plug-in for ServiceNow DevOps on your Jenkins server. No changes are required on your instances of the Now Platform.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JP
Jenkins plug-in for ServiceNow DevOps · ServiceNow
before 1.38.1 · source: vendor
SD
Servicenow Devops · Jenkins
before 1.38.1 · source: NVD
Affected product
JP
Jenkins plug-in for ServiceNow DevOps
ServiceNow
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-3442
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-3442
Third Party Advisory
https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1434119
More from Jenkins plug-in for ServiceNow DevOps
6.5
CVE-2023-3414
Cross-Site Request Forgery (CSRF) in Jenkins Plug-in for ServiceNow DevOps