CVE-2022-46389

Published: Apr 17, 2023Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

There exists a reflected XSS within the logout functionality of ServiceNow versions lower than Quebec Patch 10 Hotfix 11b, Rome Patch 10 Hotfix 3b, San Diego Patch 9, Tokyo Patch 4, and Utah GA. This enables an unauthenticated remote attacker to execute arbitrary JavaScript code in the browser-based web console.

Affected (47)

Products: Servicenow: Servicenow

Servicenow

1 product

Servicenow

Configuration A

47 vulnerable

Vulnerable Software	Affected Versions
Servicenow Servicenow	Version quebec
Servicenow Servicenow	Version rome
Servicenow Servicenow	Version rome early_availability
Servicenow Servicenow	Version rome patch_10
Servicenow Servicenow	Version rome patch_1
Servicenow Servicenow	Version rome patch_1_hotfix_1a
Servicenow Servicenow	Version rome patch_1_hotfix_1b
Servicenow Servicenow	Version rome patch_2
Servicenow Servicenow	Version rome patch_3
Servicenow Servicenow	Version rome patch_4
Servicenow Servicenow	Version rome patch_4_hotfix_1
Servicenow Servicenow	Version rome patch_4_hotfix_1a
Servicenow Servicenow	Version rome patch_4_hotfix_1b
Servicenow Servicenow	Version rome patch_5
Servicenow Servicenow	Version rome patch_6
Servicenow Servicenow	Version rome patch_7
Servicenow Servicenow	Version rome patch_7a
Servicenow Servicenow	Version rome patch_7b
Servicenow Servicenow	Version rome patch_8
Servicenow Servicenow	Version rome patch_9
Servicenow Servicenow	Version rome patch_9a
Servicenow Servicenow	Version san_diego
Servicenow Servicenow	Version san_diego patch_1
Servicenow Servicenow	Version san_diego patch_1_hotfix_1
Servicenow Servicenow	Version san_diego patch_1_hotfix_1a
Servicenow Servicenow	Version san_diego patch_1_hotfix_1b
Servicenow Servicenow	Version san_diego patch_2
Servicenow Servicenow	Version san_diego patch_3
Servicenow Servicenow	Version san_diego patch_4
Servicenow Servicenow	Version san_diego patch_4a
Servicenow Servicenow	Version san_diego patch_4b
Servicenow Servicenow	Version san_diego patch_5
Servicenow Servicenow	Version san_diego patch_6
Servicenow Servicenow	Version san_diego patch_7
Servicenow Servicenow	Version san_diego patch_7b
Servicenow Servicenow	Version san_diego patch_8
Servicenow Servicenow	Version tokyo
Servicenow Servicenow	Version tokyo early_availability
Servicenow Servicenow	Version tokyo patch_1
Servicenow Servicenow	Version tokyo patch_1a
Servicenow Servicenow	Version tokyo patch_1b
Servicenow Servicenow	Version tokyo patch_2
Servicenow Servicenow	Version tokyo patch_3
Servicenow Servicenow	Version utah
Servicenow Servicenow	Version utah early_availability
Servicenow Servicenow	Version utah patch_1
Servicenow Servicenow	Version utah patch_2

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1272156

Source: psirt@servicenow.com

Vendor Advisory

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1272156

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.