CVE-2023-3442 Missing Authorization in Jenkins plug-in for ServiceNow DevOps
Attackers can access sensitive information due to missing authorization checks in the Jenkins ServiceNow DevOps plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-3442?
CVE-2023-3442 is a high-severity missing authorization vulnerability in Jenkins plug-in for ServiceNow DevOps, published on 26 Jul 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A missing authorization vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could cause the unwanted exposure of sensitive information. To address this issue, apply the 1.38.1 version of the Jenkins plug-in for ServiceNow DevOps on your Jenkins server. No changes are required on your instances of the Now Platform.
Weakness: CWE-862
Which versions are affected by CVE-2023-3442?
2 open source packages ship an affected version, including io.jenkins.plugins:servicenow-devops. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
io.jenkins.plugins:servicenow-devops Maven | All versions | 1.38.1 |
io.jenkins.plugins:servicenow-devops Maven | All versions | 1.38.1 |
Products include Jenkins Servicenow Devops.
How do I fix CVE-2023-3442?
Upgrade io.jenkins.plugins:servicenow-devops to 1.38.1 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-3442 being exploited?
There is no known exploitation of CVE-2023-3442 in the wild and no public exploit code.
Other vulnerabilities in Jenkins plug-in for ServiceNow DevOps
Sources
Also known as GHSA-cj2x-r74q-vcx9.