Masked (encrypted) catalog item variable values do not seem to be really encrypted ???

Valon Sheremeti
Kilo Guru

Hi all.

I'm a bit puzzled.

I've been using masked type variable in my catalog item for capturing SSN value.

Per ServiceNow documentation "Since a masked variable uses platform encryption using TripleDES, the values for this variable are also encrypted"

However, my experience is different. When I impersonate an ITIL user and when I go to "sc_item_option_mtom" table list view I am able to see un-encrypted variable values.

Am I missing something?

 

find_real_file.png

1 ACCEPTED SOLUTION

Valon Sheremeti
Kilo Guru

I have upgraded my instance to London and this issue seems to be ongoing.

I am able to see un-encrypted masked variable value in "value" field  of  "sc_item_option" table.

I hope this vulnerability will be addressed soon.

 

find_real_file.png

 

View solution in original post

5 REPLIES 5

hi,

But still on the RITM record, the variable is not getting encrypted.

 

THanks