Lucene search

[email protected]CVE-2022-43684

HistoryJun 13, 2023 - 7:15 p.m.

CVE-2022-43684

2023-06-1319:15:09

CWE-668

CWE-200

[email protected]

web.nvd.nist.gov

servicenow

patches

upgrades

acl bypass

cve-2022-43684

security

nvd

9.9 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

41.2%

JSON

ServiceNow has released patches and an upgrade that address an Access Control List (ACL) bypass issue in ServiceNow Core functionality.

Additional Details

This issue is present in the following supported ServiceNow releases:

Quebec prior to Patch 10 Hot Fix 8b
Rome prior to Patch 10 Hot Fix 1
San Diego prior to Patch 7
Tokyo prior to Tokyo Patch 1; and
Utah prior to Utah General Availability

If this ACL bypass issue were to be successfully exploited, it potentially could allow an authenticated user to obtain sensitive information from tables missing authorization controls.

Affected configurations

NVD

Node

servicenowservicenowMatchquebecpatch_1_hotfix_1

servicenowservicenowMatchquebecpatch_10

servicenowservicenowMatchquebecpatch_10_hotfix_3

servicenowservicenowMatchquebecpatch_10_hotfix_3a

servicenowservicenowMatchquebecpatch_10_hotfix_3b

servicenowservicenowMatchquebecpatch_10_hotfix_4

servicenowservicenowMatchquebecpatch_2

servicenowservicenowMatchquebecpatch_2_hotfix_1

servicenowservicenowMatchquebecpatch_2_hotfix_2

servicenowservicenowMatchquebecpatch_3

servicenowservicenowMatchquebecpatch_4

servicenowservicenowMatchquebecpatch_4_hotfix_2

servicenowservicenowMatchquebecpatch_5

servicenowservicenowMatchquebecpatch_6

servicenowservicenowMatchquebecpatch_7

servicenowservicenowMatchquebecpatch_8

servicenowservicenowMatchquebecpatch_9

servicenowservicenowMatchromepatch_1

servicenowservicenowMatchromepatch_1_hotfix_1

servicenowservicenowMatchromepatch_1_hotfix_1a

servicenowservicenowMatchromepatch_1_hotfix_1b

servicenowservicenowMatchromepatch_1_hotfix_2

servicenowservicenowMatchromepatch_1_hotfix_3

servicenowservicenowMatchromepatch_10

servicenowservicenowMatchromepatch_2

servicenowservicenowMatchromepatch_2_hotfix_1

servicenowservicenowMatchromepatch_2_hotfix_2

servicenowservicenowMatchromepatch_3

servicenowservicenowMatchromepatch_3_hotfix_1

servicenowservicenowMatchromepatch_4

servicenowservicenowMatchromepatch_4_hotfix_1

servicenowservicenowMatchromepatch_4_hotfix_1a

servicenowservicenowMatchromepatch_4_hotfix_1b

servicenowservicenowMatchromepatch_5

servicenowservicenowMatchromepatch_5_hotfix_1

servicenowservicenowMatchromepatch_5_hotfix_2

servicenowservicenowMatchromepatch_6

servicenowservicenowMatchromepatch_6_hotfix_1

servicenowservicenowMatchromepatch_6_hotfix_2

servicenowservicenowMatchromepatch_7

servicenowservicenowMatchromepatch_7_hotfix_1

servicenowservicenowMatchromepatch_7a

servicenowservicenowMatchromepatch_7b

servicenowservicenowMatchromepatch_8

servicenowservicenowMatchromepatch_8_hotfix_1

servicenowservicenowMatchromepatch_8_hotfix_2

servicenowservicenowMatchromepatch_9

servicenowservicenowMatchromepatch_9_hotfix_1

servicenowservicenowMatchromepatch_9a

servicenowservicenowMatchromepatch_9b

servicenowservicenowMatchsan_diegopatch_1

servicenowservicenowMatchsan_diegopatch_1_hotfix_1

servicenowservicenowMatchsan_diegopatch_1_hotfix_1a

servicenowservicenowMatchsan_diegopatch_1_hotfix_1b

servicenowservicenowMatchsan_diegopatch_10_hotfix_1

servicenowservicenowMatchsan_diegopatch_10_hotfix_1a

servicenowservicenowMatchsan_diegopatch_10_hotfix_1b

servicenowservicenowMatchsan_diegopatch_10_hotfix_2

servicenowservicenowMatchsan_diegopatch_10_hotfix_2b

servicenowservicenowMatchsan_diegopatch_2

servicenowservicenowMatchsan_diegopatch_2_hotfix_1

servicenowservicenowMatchsan_diegopatch_3

servicenowservicenowMatchsan_diegopatch_3_hotfix_1

servicenowservicenowMatchsan_diegopatch_3_hotfix_2

servicenowservicenowMatchsan_diegopatch_3_hotfix_3

servicenowservicenowMatchsan_diegopatch_3_hotfix_4

servicenowservicenowMatchsan_diegopatch_4

servicenowservicenowMatchsan_diegopatch_4a

servicenowservicenowMatchsan_diegopatch_4b

servicenowservicenowMatchsan_diegopatch_5

servicenowservicenowMatchsan_diegopatch_6

servicenowservicenowMatchtokyo-

servicenowservicenowMatchutah-

CPENameOperatorVersion
servicenow:servicenowservicenoweqquebec
servicenow:servicenowservicenoweqrome
servicenow:servicenowservicenoweqsan_diego
servicenow:servicenowservicenoweqtokyo
servicenow:servicenowservicenowequtah

CPE	Name	Operator	Version
servicenow:servicenow	servicenow	eq	quebec
servicenow:servicenow	servicenow	eq	rome
servicenow:servicenow	servicenow	eq	san_diego
servicenow:servicenow	servicenow	eq	tokyo
servicenow:servicenow	servicenow	eq	utah

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Now Platform",
    "vendor": "ServiceNow",
    "versions": [
      {
        "lessThan": "Patch 10 Hot Fix 8b",
        "status": "affected",
        "version": "Quebec",
        "versionType": "custom"
      },
      {
        "lessThan": "Patch 10 Hot Fix 1",
        "status": "affected",
        "version": "Rome",
        "versionType": "custom"
      },
      {
        "lessThan": "Patch 7",
        "status": "affected",
        "version": "San Diego",
        "versionType": "custom"
      },
      {
        "lessThan": "Tokyo Patch 1",
        "status": "affected",
        "version": "Tokyo",
        "versionType": "custom"
      },
      {
        "lessThan": "Utah General Availability (GA)",
        "status": "affected",
        "version": "Utah",
        "versionType": "custom"
      }
    ]
  }
]

References

packetstormsecurity.com/files/173354/ServiceNow-Insecure-Access-Control-Full-Admin-Compromise.html

seclists.org/fulldisclosure/2023/Jul/11

news.ycombinator.com/item?id=36638530

support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1303489

x64.sh/posts/ServiceNow-Insecure-access-control-to-admin/

9.9 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

41.2%

JSON

Related for CVE-2022-43684

cvelist1 prion1 nvd1 githubexploit1