XSS in Servicenow Now Platform
CVE-2022-46389
There exists a reflected XSS within the logout functionality of ServiceNow versions lower than Quebec Patch 10 Hotfix 11b, Rome Patch 10 Hotfix 3b, San Diego Patch 9, Tokyo Patch 4, and Utah GA. This enables an unauthenticated remote attacker to execute arbitrary JavaScript code in the browser-based web console.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.006 (46.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 46th percentile — 46.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: 0.000
Affected products
- Servicenow Now Platform — versions Quebec, Rome, San Diego
- Servicenow — versions quebec, rome, san_diego
Weakness classification (CWE)
References
- support.servicenow.com/kb (Vendor Advisory)
Frequently asked questions
- What is CVE-2022-46389?
- CVE-2022-46389 is a medium-severity vulnerability in Servicenow Now Platform, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2023-04-17.
- How severe is CVE-2022-46389?
- Medium severity. CVSS v3 base score is 6.1 out of 10.