Skip to content
CVE PROGRAM SOURCE RECORD9.9 Critical

CVE-2022-43684

ACL bypass in Reporting functionality

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
SN

Description

ServiceNow has released patches and an upgrade that address an Access Control List (ACL) bypass issue in ServiceNow Core functionality. Additional Details This issue is present in the following supported ServiceNow releases: * Quebec prior to Patch 10 Hot Fix 8b * Rome prior to Patch 10 Hot Fix 1 * San Diego prior to Patch 7 * Tokyo prior to Tokyo Patch 1; and * Utah prior to Utah General Availability If this ACL bypass issue were to be successfully exploited, it potentially could allow an authenticated user to obtain sensitive information from tables missing authorization controls.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ServiceNow Now Platform

Default version status: unaffected

  • Quebec to < Patch 10 Hot Fix 8baffected
  • Rome to < Patch 10 Hot Fix 1affected
  • San Diego to < Patch 7affected
  • Tokyo to < Tokyo Patch 1affected
  • Utah to < Utah General Availability (GA)affected

References