CVE-2023-3442 Missing Authorization in Jenkins plug-in for ServiceNow DevOps

2023-07-2618:32:19

CWE-862

www.cve.org

cve-2023-3442

missing authorization

jenkins plug-in

servicenow devops

vulnerability

sensitive information

update

CVSS3

7.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

EPSS

0.002

Percentile

53.4%

JSON

A missing authorization vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could cause the unwanted exposure of sensitive information. To address this issue, apply the 1.38.1 version of the Jenkins plug-in for ServiceNow DevOps on your Jenkins server. No changes are required on your instances of the Now Platform.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Jenkins"
    ],
    "product": "Jenkins plug-in for ServiceNow DevOps",
    "repo": "https://github.com/jenkinsci/servicenow-devops-plugin",
    "vendor": "ServiceNow",
    "versions": [
      {
        "lessThan": "1.38.1",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]