Lucene search
HistoryAug 23, 2022 - 7:15 p.m.
CVE-2022-38172
servicenow
san diego
patch 3
xss
name field
performance analytics
dashboard
6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
0.001 Low
EPSS
Percentile
31.5%
ServiceNow through San Diego Patch 3 allows XSS via the name field during creation of a new dashboard for the Performance Analytics dashboard.
Affected configurations
Node
servicenowservicenowMatchsan_diegopatch_1
ORservicenowservicenowMatchsan_diegopatch_1_hotfix_1
ORservicenowservicenowMatchsan_diegopatch_1_hotfix_1a
ORservicenowservicenowMatchsan_diegopatch_1_hotfix_1b
ORservicenowservicenowMatchsan_diegopatch_2
ORservicenowservicenowMatchsan_diegopatch_2_hotfix_1
ORservicenowservicenowMatchsan_diegopatch_3
| CPE | Name | Operator | Version |
|---|---|---|---|
| servicenow:servicenow | servicenow | eq | san_diego |
Social References
More
Related
cvelist
cvelist
CVE-2022-38172
2022-08-23 18:02:07
nvd
nvd
CVE-2022-38172
2022-08-23 19:15:09
prion
prion
Cross site scripting
2022-08-23 19:15:00
6.1 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
0.001 Low
EPSS
Percentile
31.5%
Related for CVE-2022-38172