ServiceNow DevOps Plugin up to 1.38.0 on Jenkins authorization

Summaryinfo

A vulnerability described as problematic has been identified in ServiceNow DevOps Plugin up to 1.38.0 on Jenkins. The impacted element is an unknown function. The manipulation results in authorization. This vulnerability is identified as CVE-2023-3442. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as problematic, was found in ServiceNow DevOps Plugin up to 1.38.0 on Jenkins (Jenkins Plugin). Affected is an unknown code block. The manipulation with an unknown input leads to a authorization vulnerability. CWE is classifying the issue as CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on confidentiality. CVE summarizes:

A missing authorization vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could cause the unwanted exposure of sensitive information. To address this issue, apply the 1.38.1 version of the Jenkins plug-in for ServiceNow DevOps on your Jenkins server. No changes are required on your instances of the Now Platform.

The weakness was released 07/26/2023 as KB1434119. The advisory is available at support.servicenow.com. This vulnerability is traded as CVE-2023-3442 since 06/28/2023. The technical details are unknown and an exploit is not available.

Upgrading to version 1.38.1 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Jenkins Plugin

Name

• ServiceNow DevOps Plugin

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.26
• 1.27
• 1.28
• 1.29
• 1.30
• 1.31
• 1.32
• 1.33
• 1.34
• 1.35
• 1.36
• 1.37
• 1.38.0

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion