Lucene search

SNCVELIST:CVE-2022-46389

HistoryApr 17, 2023 - 12:00 a.m.

CVE-2022-46389 Cross-Site Scripting (XSS) vulnerability found on logout functionality

2023-04-1700:00:00

CWE-79

www.cve.org

cve-2022-46389; cross-site scripting; servicenow; remote attacker; browser-based; web console;

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

42.1%

JSON

There exists a reflected XSS within the logout functionality of ServiceNow versions lower than Quebec Patch 10 Hotfix 11b, Rome Patch 10 Hotfix 3b, San Diego Patch 9, Tokyo Patch 4, and Utah GA. This enables an unauthenticated remote attacker to execute arbitrary JavaScript code in the browser-based web console.

CNA Affected

[
  {
    "vendor": "ServiceNow",
    "product": "Now Platform",
    "versions": [
      {
        "version": "Quebec",
        "status": "affected",
        "lessThan": "Patch 10 Hotfix 11b",
        "versionType": "custom"
      },
      {
        "version": "Rome",
        "status": "affected",
        "lessThan": "Patch 10 Hotfix 3b",
        "versionType": "custom"
      },
      {
        "version": "San Diego",
        "status": "affected",
        "lessThan": "Patch 9",
        "versionType": "custom"
      },
      {
        "version": "Tokyo",
        "status": "affected",
        "lessThan": "Patch 4",
        "versionType": "custom"
      },
      {
        "version": "Utah",
        "status": "affected",
        "lessThan": "GA",
        "versionType": "custom"
      }
    ]
  }
]

References

support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1272156

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

42.1%

JSON

Related for CVELIST:CVE-2022-46389