CVE-2023-3414 Cross-Site Request Forgery (CSRF) in Jenkins Plug-in for ServiceNow DevOps
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2023-3414?
CVE-2023-3414 is a medium-severity vulnerability in Jenkins plug-in for ServiceNow DevOps, published on 26 Jul 2023.
Official description
A cross-site request forgery vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could cause the unwanted exposure of sensitive information. To address this issue, apply the 1.38.1 version of the Jenkins plug-in for ServiceNow DevOps on your Jenkins server. No changes are required on your instances of the Now Platform.
Weakness: CWE-352
Which versions are affected by CVE-2023-3414?
2 open source packages ship an affected version, including io.jenkins.plugins:servicenow-devops. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
io.jenkins.plugins:servicenow-devops Maven | All versions | 1.38.1 |
io.jenkins.plugins:servicenow-devops Maven | All versions | 1.38.1 |
Products include Jenkins Servicenow Devops.
How do I fix CVE-2023-3414?
Upgrade io.jenkins.plugins:servicenow-devops to 1.38.1 or later.
Is CVE-2023-3414 being exploited?
There is no known exploitation of CVE-2023-3414 in the wild and no public exploit code.
Other vulnerabilities in Jenkins plug-in for ServiceNow DevOps
Sources
Also known as GHSA-rchx-rvh2-vx5j.