title: Missing Authorization in Jenkins plug-in for ServiceNow DevOps
description: A missing authorization vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could cause the unwanted exposure of sensitive information. To address this issue, apply the 1.38.1 version of the Jenkins plug-in for ServiceNow DevOps on your Jenkins server.  No changes are required on your instances of the Now Platform.
problem types: CWE-862 Missing Authorization
affected:
{
defaultStatus: unaffected
platforms: Jenkins
product: Jenkins plug-in for ServiceNow DevOps
repo: https://github.com/jenkinsci/servicenow-devops-plugin
vendor: ServiceNow
versions:
lessThan: 1.38.1, status: affected, version: 0, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL