Skip to content
CVE PROGRAM SOURCE RECORD6.1 Medium

CVE-2022-46389

Cross-Site Scripting (XSS) vulnerability found on logout functionality

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
SN

Description

There exists a reflected XSS within the logout functionality of ServiceNow versions lower than Quebec Patch 10 Hotfix 11b, Rome Patch 10 Hotfix 3b, San Diego Patch 9, Tokyo Patch 4, and Utah GA. This enables an unauthenticated remote attacker to execute arbitrary JavaScript code in the browser-based web console.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ServiceNow Now Platform

  • Quebec to < Patch 10 Hotfix 11baffected
  • Rome to < Patch 10 Hotfix 3baffected
  • San Diego to < Patch 9affected
  • Tokyo to < Patch 4affected
  • Utah to < GAaffected

References