5.4

CVE-2019-20768

Exploit
ServiceNow IT Service Management Kingston through Patch 14-1, London through Patch 7, and Madrid before patch 4 allow stored XSS via crafted sysparm_item_guid and sys_id parameters in an Incident Request to service_catalog.do.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Servicenow ≫ It Service Management Version kingston Update -
Servicenow ≫ It Service Management Version kingston Update patch_1
Servicenow ≫ It Service Management Version kingston Update patch_10
Servicenow ≫ It Service Management Version kingston Update patch_10-1
Servicenow ≫ It Service Management Version kingston Update patch_10-2
Servicenow ≫ It Service Management Version kingston Update patch_11
Servicenow ≫ It Service Management Version kingston Update patch_12
Servicenow ≫ It Service Management Version kingston Update patch_12-1
Servicenow ≫ It Service Management Version kingston Update patch_12-2
Servicenow ≫ It Service Management Version kingston Update patch_13
Servicenow ≫ It Service Management Version kingston Update patch_14
Servicenow ≫ It Service Management Version kingston Update patch_14-1
Servicenow ≫ It Service Management Version kingston Update patch_2
Servicenow ≫ It Service Management Version kingston Update patch_3
Servicenow ≫ It Service Management Version kingston Update patch_3-1
Servicenow ≫ It Service Management Version kingston Update patch_3-2
Servicenow ≫ It Service Management Version kingston Update patch_3a-1
Servicenow ≫ It Service Management Version kingston Update patch_4
Servicenow ≫ It Service Management Version kingston Update patch_4-1
Servicenow ≫ It Service Management Version kingston Update patch_4-2
Servicenow ≫ It Service Management Version kingston Update patch_4-4
Servicenow ≫ It Service Management Version kingston Update patch_5
Servicenow ≫ It Service Management Version kingston Update patch_6
Servicenow ≫ It Service Management Version kingston Update patch_6-1
Servicenow ≫ It Service Management Version kingston Update patch_6-2
Servicenow ≫ It Service Management Version kingston Update patch_6-3
Servicenow ≫ It Service Management Version kingston Update patch_6-5
Servicenow ≫ It Service Management Version kingston Update patch_7
Servicenow ≫ It Service Management Version kingston Update patch_7-1
Servicenow ≫ It Service Management Version kingston Update patch_8
Servicenow ≫ It Service Management Version kingston Update patch_8-1
Servicenow ≫ It Service Management Version kingston Update patch_9
Servicenow ≫ It Service Management Version london Update -
Servicenow ≫ It Service Management Version london Update patch_1
Servicenow ≫ It Service Management Version london Update patch_1-2
Servicenow ≫ It Service Management Version london Update patch_1-3
Servicenow ≫ It Service Management Version london Update patch_2
Servicenow ≫ It Service Management Version london Update patch_2-2
Servicenow ≫ It Service Management Version london Update patch_2-4
Servicenow ≫ It Service Management Version london Update patch_2-5
Servicenow ≫ It Service Management Version london Update patch_3
Servicenow ≫ It Service Management Version london Update patch_3-3
Servicenow ≫ It Service Management Version london Update patch_3-4
Servicenow ≫ It Service Management Version london Update patch_4
Servicenow ≫ It Service Management Version london Update patch_4-1
Servicenow ≫ It Service Management Version london Update patch_4-2
Servicenow ≫ It Service Management Version london Update patch_4-3
Servicenow ≫ It Service Management Version london Update patch_4-4
Servicenow ≫ It Service Management Version london Update patch_4-5
Servicenow ≫ It Service Management Version london Update patch_4-6
Servicenow ≫ It Service Management Version london Update patch_5
Servicenow ≫ It Service Management Version london Update patch_5-1
Servicenow ≫ It Service Management Version london Update patch_6
Servicenow ≫ It Service Management Version london Update patch_6-1
Servicenow ≫ It Service Management Version london Update patch_6a-1
Servicenow ≫ It Service Management Version london Update patch_6b-1
Servicenow ≫ It Service Management Version london Update patch_7
Servicenow ≫ It Service Management Version madrid Update -
Servicenow ≫ It Service Management Version madrid Update patch_0-1
Servicenow ≫ It Service Management Version madrid Update patch_1
Servicenow ≫ It Service Management Version madrid Update patch_1-1
Servicenow ≫ It Service Management Version madrid Update patch_1-2
Servicenow ≫ It Service Management Version madrid Update patch_2
Servicenow ≫ It Service Management Version madrid Update patch_3
Servicenow ≫ It Service Management Version madrid Update patch_3-1
Servicenow ≫ It Service Management Version madrid Update patch_3-2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.72% 0.49
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.4 2.3 2.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
NIST 3.5 6.8 2.9
AV:N/AC:M/Au:S/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://outpost24.com/blog/Responsible-disclosure-Multiple-stored-XSS-vulnerabilities-discovered-in-ServiceNow-ITSM
Third Party Advisory
Exploit
https://outpost24.com/blog?tags=307
Third Party Advisory