Home > Vulnerability Database > CVE-2023-3414

Mend.io Vulnerability Database

CVE-2023-3414

Date: July 26, 2023

A cross-site request forgery vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could cause the unwanted exposure of sensitive information. To address this issue, apply the 1.38.1 version of the Jenkins plug-in for ServiceNow DevOps on your Jenkins server. No changes are required on your instances of the Now Platform.

Language: Java

Severity Score

6.1

Related Resources (7)

Url: https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1434118

Url: https://nvd.nist.gov/vuln/detail/CVE-2023-3414

Url: https://github.com/jenkinsci/servicenow-devops-plugin

Url: https://github.com/jenkinsci/servicenow-devops-plugin/releases/tag/v1.38.1

Url: https://github.com/jenkinsci/servicenow-devops-plugin/commit/67192e24099787ad732b41d581f20714d4253921

Url: https://github.com/jenkinsci/servicenow-devops-plugin/commit/d7d2422b016995402dd245d9c9c5c2f4cf00c691

Url: https://www.mend.io/vulnerability-database/CVE-2023-3414

Severity Score

6.1

Weakness Type (CWE)

Cross-Site Request Forgery (CSRF)

CWE-352

Exposure of Sensitive Information to an Unauthorized Actor

CWE-200

CVSS v3.1

Base Score:	6.1
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	HIGH
Privileges Required (PR):	NONE
User Interaction (UI):	REQUIRED
Scope (S):	CHANGED
Confidentiality (C):	HIGH
Integrity (I):	NONE
Availability (A):	NONE

Mend.io Vulnerability Database

We found results for “”

CVE-2023-3414

Date: July 26, 2023

Language: Java

Severity Score

Related Resources (7)

Severity Score

Weakness Type (CWE)

CVSS v3.1

Do you need more information?