5.4
CVE-2022-42704
- EPSS 0.22%
- Veröffentlicht 13.01.2023 00:15:09
- Zuletzt bearbeitet 09.04.2025 14:15:25
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
LoginA cross-site scripting (XSS) vulnerability in Employee Service Center (esc) and Service Portal (sp) in ServiceNow Quebec, Rome, and San Diego allows remote attackers to inject arbitrary web script via the Standard Ticket Conversations widget.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Servicenow ≫ Servicenow Versionquebec
Servicenow ≫ Servicenow Versionrome
Servicenow ≫ Servicenow Versionrome Updatepatch_1
Servicenow ≫ Servicenow Versionrome Updatepatch_2
Servicenow ≫ Servicenow Versionrome Updatepatch_3
Servicenow ≫ Servicenow Versionrome Updatepatch_4
Servicenow ≫ Servicenow Versionsan_diego
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.22% | 0.44 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 5.4 | 2.3 | 2.7 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
|
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | 5.4 | 2.3 | 2.7 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
|
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.