Cyber Resilience

CVE-2023-3414

CSRF in Jenkins Servicenow Devops ≤ 1.38.1

Published
26 July 2023
Modified
21 November 2024
CVSS Score v3.1 6.1
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
EPSS Score 0.0041 34th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2023-3414 is a medium-severity CSRF (CWE-352) vulnerability in Jenkins Servicenow Devops. Its CVSS base score is 6.1 (Medium).

Operationally, ranked at the 34th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

A cross-site request forgery vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could cause the unwanted exposure of sensitive information. To address this issue, apply the 1.38.1 version of the…

more

Jenkins plug-in for ServiceNow DevOps on your Jenkins server. No changes are required on your instances of the Now Platform.

CWE(s)

Related Threats

CVEs Like This One

CVE-2023-32980Same vendor: Jenkins
CVE-2025-24402Same vendor: Jenkins
CVE-2023-41946Same vendor: Jenkins
CVE-2023-28674Same vendor: Jenkins
CVE-2023-37955Same vendor: Jenkins
CVE-2023-37964Same vendor: Jenkins
CVE-2023-50775Same vendor: Jenkins
CVE-2023-40336Same vendor: Jenkins
CVE-2023-24452Same vendor: Jenkins
CVE-2023-43502Same vendor: Jenkins

Affected Assets

jenkins
servicenow devops
≤ 1.38.1

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V3.3.2
  • V3.5.1
  • V10.2.1

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-352

Awareness training educates users on avoiding untrusted links and actions that can be exploited via CSRF.

addresses: CWE-352

Requiring user re-entry of credentials for sensitive actions prevents automated forgery of requests without active user participation.

addresses: CWE-352

Security testing regimens explicitly include checks for missing or ineffective anti-CSRF protections in web applications.

addresses: CWE-352

Detects anomalous request patterns consistent with cross-site request forgery.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require anti-CSRF controls such as tokens or SameSite attributes.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

mitigates

By denying access to phishing or malicious sites, the control lowers the likelihood that a user will be tricked into submitting a forged request that performs an unintended action on another site.

none

Contextual intelligence about emerging CSRF toolkits can be translated into updated anti-CSRF token or same-site policy configurations across applications.

References