{"id":"CVE-2023-3414","summary":"Cross-Site Request Forgery (CSRF) in Jenkins Plug-in for ServiceNow DevOps","details":"A cross-site request forgery vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could cause the unwanted exposure of sensitive information. To address this issue, apply the 1.38.1 version of the Jenkins plug-in for ServiceNow DevOps on your Jenkins server.  No changes are required on your instances of the Now Platform. \n","aliases":["GHSA-rchx-rvh2-vx5j"],"modified":"2026-07-15T01:49:08.408033383Z","published":"2023-07-26T18:20:18.253Z","database_specific":{"cwe_ids":["CWE-352"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3414.json","cna_assigner":"SN"},"references":[{"type":"WEB","url":"https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1434118"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3414.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-3414"},{"type":"PACKAGE","url":"https://github.com/jenkinsci/servicenow-devops-plugin"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jenkinsci/servicenow-devops-plugin","events":[{"introduced":"0"},{"fixed":"a3e35026011ecfec59ae145a1603195dff409bc9"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.38.1"}],"source":"AFFECTED_FIELD"}}],"versions":["v1.37.0","v1.36.0","v1.35.0","v1.34.2","v1.34.1","v1.33.3","v1.32","v1.31","servicenow-devops-1.30","servicenow-devops-1.29"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-3414.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N"}]}