CVE-2023-3414: Cross-Site Request Forgery (CSRF)
(updated )
A cross-site request forgery vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could cause the unwanted exposure of sensitive information. To address this issue, apply the 1.38.1 version of the Jenkins plug-in for ServiceNow DevOps on your Jenkins server. No changes are required on your instances of the Now Platform.
References
- github.com/advisories/GHSA-rchx-rvh2-vx5j
- github.com/jenkinsci/servicenow-devops-plugin/commit/67192e24099787ad732b41d581f20714d4253921
- github.com/jenkinsci/servicenow-devops-plugin/commit/d7d2422b016995402dd245d9c9c5c2f4cf00c691
- github.com/jenkinsci/servicenow-devops-plugin/releases/tag/v1.38.1
- nvd.nist.gov/vuln/detail/CVE-2023-3414
- support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1434118
Code Behaviors & Features
Detect and mitigate CVE-2023-3414 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →