Random change being updated with post step when sys_id="null"

[DonaldKallman]

This is probably a longshot since it looks like this project is not updated often. We have automated our change management process and when a jenkins job fails before this plugin can create the change, the post step that usually closes or cancels the change is updating a random change on our servicenow account. The request reads in an environment variable that is "null" since it never got set in the previous steps for correlation_id. Somehow a random sys_id is used for correlation_id for a completely unrelated change (seems like whatever change is the most recent on the change table is the sys_id that gets used) and winds up updating the close note for a random change request.

Version report

Jenkins and plugins versions report:

Jenkins: 2.263.2.2
OS: Linux - 3.10.0-1160.15.2.el7.x86_64
---
github-oauth:0.33
resource-disposer:0.14
blueocean-web:1.24.3
operations-center-notification:1.1
handlebars:1.1.1
bouncycastle-api:2.18
blueocean:1.24.3
run-condition:1.3
cloudbees-servicenow-jenkins-plugin:1.2.13
config-file-provider:3.7.0
kubernetes-credentials:0.7.0
junit:1.47
cloudbees-assurance:2.138.0.23
blueocean-commons:1.24.3
jacoco:3.1.0
cobertura:1.16
maven-plugin:3.8
rebuild:1.31
esr-reporter:2.235.0.3
token-macro:2.13
blueocean-dashboard:1.24.3
ssh-credentials:1.18.1
devoptics:1.1934
test-results-analyzer:0.3.5
parameterized-trigger:2.39
durable-task:1.35
variant:1.3
google-deployment-manager:0.1
dynamic_extended_choice_parameter:1.0.1
data-tables-api:1.10.21-3
pipeline-input-step:2.12
github-pr-coverage-status:2.1.1
unique-id:2.2.0
blueocean-pipeline-editor:1.24.3
jackson2-api:2.12.0
blueocean-events:1.24.3
job-dsl:1.77
ldap:1.26
http_request:1.8.26
envinject:2.3.0
jquery3-api:3.5.1-2
email-ext:2.81
checks-api:1.1.1
dtkit-api:3.0.0
cloudbees-analytics:1.27
blueocean-core-js:1.24.3
branch-api:2.6.2
docker-commons:1.17
role-strategy:3.1
pipeline-rest-api:2.15
plot:2.1.8
mercurial:2.12
handy-uri-templates-2-api:2.1.8-1.0
kubernetes-client-api:4.11.1
external-monitor-job:1.7
pipeline-stage-tags-metadata:1.7.2
git-client:3.5.1
pipeline-build-step:2.13
oauth-credentials:0.4
aws-credentials:1.28
veracode-jenkins-plugin:18.5.5.7
aws-lambda:0.5.10
google-oauth-plugin:1.0.2
cloudbees-folder:6.15
okhttp-api:3.14.9
google-metadata-plugin:0.3.1
analysis-model-api:9.4.0
view-job-filters:2.3
plugin-usage-plugin:1.1
pipeline-aws:1.43
trilead-api:1.0.10
awseb-deployment-plugin:0.3.21
Office-365-Connector:4.13.2
sonar:2.13
blueocean-autofavorite:1.2.4
mailer:1.32.1
matrix-auth:2.6.4
echarts-api:4.9.0-2
git-changelog:3.0
ws-cleanup:0.38
nectar-rbac:5.51
momentjs:1.1.1
bootstrap4-api:4.5.3-1
active-directory:2.22
credentials-binding:1.24
async-http-client:1.7.24.3
docker-workflow:1.25
operations-center-agent:2.263.0.1
copyartifact:1.45.3
apache-httpcomponents-client-4-api:4.5.10-2.0
openJDK-native-plugin:1.4
pipeline-utility-steps:2.6.1
cloudbees-jenkins-advisor:3.2.2
sse-gateway:1.24
blueocean-rest:1.24.3
matrix-project:1.18
metrics:4.0.2.6
cloudbees-folders-plus:3.10
envinject-api:1.7
cloudbees-license:9.49
build-user-vars-plugin:1.6
operations-center-client:2.263.0.1
git-server:1.9
slack:2.42
nectar-license:8.29
warnings-ng:8.4.4
workflow-durable-task-step:2.37
github:1.32.0
blueocean-jwt:1.24.3
cloudbees-aws-deployer:1.18
kubernetes:1.28.3
kube-agent-management:1.1.42
script-security:1.75
workflow-multibranch:2.22
embeddable-build-status:2.0.3
structs:1.20
xunit:2.3.9
extended-read-permission:3.2
pam-auth:1.5.1
pipeline-stage-view:2.15
workflow-cps-checkpoint:2.10
conditional-buildstep:1.4.0
blueocean-personalization:1.24.3
categorized-view:1.10
pipeline-maven:3.9.3
service-now:0.0.4
workflow-api:2.40
operations-center-context:2.263.0.4
command-launcher:1.5
timestamper:1.11.8
authentication-tokens:1.4
splunk-devops:1.9.5
build-pipeline-plugin:1.5.8
blueocean-i18n:1.24.3
jaxb:2.3.0.1
deployer-framework:1.3
workflow-aggregator:2.5
favorite:2.3.2
display-url-api:2.3.4
file-operations:1.11
workflow-cps-global-lib:2.17
infradna-backup:3.38.29
github-api:1.117
cloudbees-cyberark-credentials:1.0.5
workflow-job:2.40
pipeline-model-definition:1.7.2
snakeyaml-api:1.27.0
cloudbees-uc-data-api:4.43
monitoring:1.86.0
cloudbees-support:3.26
esr-config:2.235.0.3
aws-beanstalk-publisher-plugin:1.8.1
cloudbees-blueocean-default-theme:0.8
splunk-devops-extend:1.9.5
pubsub-light:1.13
ansicolor:0.7.3
blueocean-bitbucket-pipeline:1.24.3
pipeline-model-declarative-agent:1.1.1
pipeline-milestone-step:1.3.1
jira:3.1.3
hashicorp-vault-plugin:3.7.0
testng-plugin:1.15
extended-choice-parameter:0.82
pipeline-multibranch-defaults:2.1
h2-api:1.4.199
htmlpublisher:1.25
jquery:1.12.4-1
mapdb-api:1.0.9.0
dependency-check-jenkins-plugin:5.1.1
build-monitor-plugin:1.12+build.201809061734
code-coverage-api:1.2.0
aws-bucket-credentials:1.0.0
nexus-artifact-uploader:2.13
javadoc:1.6
nexus-jenkins-plugin:3.10.20201208-151941.d953318
cloudbees-bitbucket-branch-source:2.9.4
cloudbees-administrative-monitors:1.0.1
font-awesome-api:5.15.1-1
aws-java-sdk:1.11.854
git:4.4.5
workflow-step-api:2.23
jquery-ui:1.0.2
support-core:2.72
jquery-detached:1.2.1
workflow-basic-steps:2.23
forensics-api:0.7.0
blueocean-github-pipeline:1.24.3
plain-credentials:1.7
blueocean-config:1.24.3
workflow-scm-step:2.11
pipeline-model-extensions:1.7.2
jenkins-multijob-plugin:1.36
google-source-plugin:0.4
blueocean-jira:1.24.3
blueocean-display-url:2.4.0
built-on-column:1.1
plugin-util-api:1.5.0
greenballs:1.15.1
blueocean-pipeline-scm-api:1.24.3
pipeline-model-api:1.7.2
scm-api:2.6.4
jenkins-design-language:1.24.3
ant:1.11
jsch:0.1.55.2
blueocean-rest-impl:1.24.3
ansible-tower:0.16.0
popper-api:1.16.0-7
windows-slaves:1.7
subversion:2.13.2
blueocean-pipeline-api-impl:1.24.3
github-branch-source:2.9.1
credentials:2.3.14
pipeline-github:2.7
form-element-path:1.8
nodejs:1.3.10
github-coverage-reporter:1.9
pipeline-stage-step:2.5
jdk-tool:1.4
versionnumber:1.9
workflow-support:3.7
ace-editor:1.1
jobConfigHistory:2.26
pipeline-graph-analysis:1.10
workflow-cps:2.87
cloudbees-aws-cli:1.5.12
deployed-on-column:1.8
antisamy-markup-formatter:2.1
notification-api:1.5
blueocean-git-pipeline:1.24.3

• What Operating System are you using (both controller, and any agents involved in the problem)?

Kubernetes - Docker image (I think it's alpine)

Reproduction steps

• Run updateChangeRequest with a correlation_id = "null"

Results

Expected result:

Fail to update any change as an invalid correlation_id was passed

Actual result:

Seems to update a change request at random, not sure where it gets the sys_id from.