6.1

CVE-2022-39048

Cross-Site Scripting (XSS) vulnerability in ServiceNow UI page assessment_redirect

A XSS vulnerability was identified in the ServiceNow UI page assessment_redirect. To exploit this vulnerability, an attacker would need to persuade an authenticated user to click a maliciously crafted URL. Successful exploitation potentially could be used to conduct various client-side attacks, including, but not limited to, phishing, redirection, theft of CSRF tokens, and use of an authenticated user's browser or session to attack other systems.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Servicenow ≫ Servicenow Version quebec Update -
Servicenow ≫ Servicenow Version quebec Update patch_10
Servicenow ≫ Servicenow Version rome Update patch_1
Servicenow ≫ Servicenow Version rome Update patch_1_hotfix_1
Servicenow ≫ Servicenow Version rome Update patch_1_hotfix_1b
Servicenow ≫ Servicenow Version rome Update patch_1_hotfix_2
Servicenow ≫ Servicenow Version rome Update patch_1_hotfix_3
Servicenow ≫ Servicenow Version rome Update patch_10
Servicenow ≫ Servicenow Version rome Update patch_10_hotfix_1
Servicenow ≫ Servicenow Version rome Update patch_10_hotfix_2
Servicenow ≫ Servicenow Version rome Update patch_10_hotfix_2a
Servicenow ≫ Servicenow Version rome Update patch_2
Servicenow ≫ Servicenow Version rome Update patch_2_hotfix_1
Servicenow ≫ Servicenow Version rome Update patch_2_hotfix_2
Servicenow ≫ Servicenow Version rome Update patch_3
Servicenow ≫ Servicenow Version rome Update patch_3_hotfix_1
Servicenow ≫ Servicenow Version rome Update patch_4
Servicenow ≫ Servicenow Version rome Update patch_4_hotfix_1
Servicenow ≫ Servicenow Version rome Update patch_4_hotfix_1a
Servicenow ≫ Servicenow Version rome Update patch_4_hotfix_1b
Servicenow ≫ Servicenow Version rome Update patch_5
Servicenow ≫ Servicenow Version rome Update patch_5_hotfix_1
Servicenow ≫ Servicenow Version rome Update patch_5_hotfix_2
Servicenow ≫ Servicenow Version rome Update patch_6
Servicenow ≫ Servicenow Version rome Update patch_6_hotfix_1
Servicenow ≫ Servicenow Version rome Update patch_6_hotfix_2
Servicenow ≫ Servicenow Version rome Update patch_7
Servicenow ≫ Servicenow Version rome Update patch_7_hotfix_1
Servicenow ≫ Servicenow Version rome Update patch_7a
Servicenow ≫ Servicenow Version rome Update patch_7b
Servicenow ≫ Servicenow Version rome Update patch_8
Servicenow ≫ Servicenow Version rome Update patch_8_hotfix_1
Servicenow ≫ Servicenow Version rome Update patch_8_hotfix_2
Servicenow ≫ Servicenow Version rome Update patch_9
Servicenow ≫ Servicenow Version rome Update patch_9_hotfix_1
Servicenow ≫ Servicenow Version rome Update patch_9a
Servicenow ≫ Servicenow Version rome Update patch_9b
Servicenow ≫ Servicenow Version san_diego Update patch_1
Servicenow ≫ Servicenow Version san_diego Update patch_1_hotfix_1
Servicenow ≫ Servicenow Version san_diego Update patch_1_hotfix_1a
Servicenow ≫ Servicenow Version san_diego Update patch_1_hotfix_1b
Servicenow ≫ Servicenow Version san_diego Update patch_2
Servicenow ≫ Servicenow Version san_diego Update patch_2_hotfix_1
Servicenow ≫ Servicenow Version san_diego Update patch_3
Servicenow ≫ Servicenow Version san_diego Update patch_3_hotfix_1
Servicenow ≫ Servicenow Version san_diego Update patch_3_hotfix_2
Servicenow ≫ Servicenow Version san_diego Update patch_3_hotfix_3
Servicenow ≫ Servicenow Version san_diego Update patch_3_hotfix_4
Servicenow ≫ Servicenow Version san_diego Update patch_4
Servicenow ≫ Servicenow Version san_diego Update patch_4a
Servicenow ≫ Servicenow Version san_diego Update patch_4b
Servicenow ≫ Servicenow Version san_diego Update patch_6
Servicenow ≫ Servicenow Version san_diego Update patch_7
Servicenow ≫ Servicenow Version san_diego Update patch_8
Servicenow ≫ Servicenow Version tokyo Update -
Servicenow ≫ Servicenow Version tokyo Update patch1
Servicenow ≫ Servicenow Version utah Update -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.09% 0.61
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
psirt@servicenow.com 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://support.servicenow.com/
https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1221892