6.5

CVE-2022-43684

ACL bypass in Reporting functionality

ServiceNow has released patches and an upgrade that address an Access Control List (ACL) bypass issue in ServiceNow Core functionality.



Additional Details

This issue is present in the following supported ServiceNow releases: 



  *  Quebec prior to Patch 10 Hot Fix 8b
  *  Rome prior to Patch 10 Hot Fix 1
  *  San Diego prior to Patch 7
  *  Tokyo prior to Tokyo Patch 1; and 
  *  Utah prior to Utah General Availability 




If this ACL bypass issue were to be successfully exploited, it potentially could allow an authenticated user to obtain sensitive information from tables missing authorization controls.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Servicenow ≫ Servicenow Version quebec Update patch_1_hotfix_1
Servicenow ≫ Servicenow Version quebec Update patch_10
Servicenow ≫ Servicenow Version quebec Update patch_10_hotfix_3
Servicenow ≫ Servicenow Version quebec Update patch_10_hotfix_3a
Servicenow ≫ Servicenow Version quebec Update patch_10_hotfix_3b
Servicenow ≫ Servicenow Version quebec Update patch_10_hotfix_4
Servicenow ≫ Servicenow Version quebec Update patch_2
Servicenow ≫ Servicenow Version quebec Update patch_2_hotfix_1
Servicenow ≫ Servicenow Version quebec Update patch_2_hotfix_2
Servicenow ≫ Servicenow Version quebec Update patch_3
Servicenow ≫ Servicenow Version quebec Update patch_4
Servicenow ≫ Servicenow Version quebec Update patch_4_hotfix_2
Servicenow ≫ Servicenow Version quebec Update patch_5
Servicenow ≫ Servicenow Version quebec Update patch_6
Servicenow ≫ Servicenow Version quebec Update patch_7
Servicenow ≫ Servicenow Version quebec Update patch_8
Servicenow ≫ Servicenow Version quebec Update patch_9
Servicenow ≫ Servicenow Version rome Update patch_1
Servicenow ≫ Servicenow Version rome Update patch_1_hotfix_1
Servicenow ≫ Servicenow Version rome Update patch_1_hotfix_1a
Servicenow ≫ Servicenow Version rome Update patch_1_hotfix_1b
Servicenow ≫ Servicenow Version rome Update patch_1_hotfix_2
Servicenow ≫ Servicenow Version rome Update patch_1_hotfix_3
Servicenow ≫ Servicenow Version rome Update patch_10
Servicenow ≫ Servicenow Version rome Update patch_2
Servicenow ≫ Servicenow Version rome Update patch_2_hotfix_1
Servicenow ≫ Servicenow Version rome Update patch_2_hotfix_2
Servicenow ≫ Servicenow Version rome Update patch_3
Servicenow ≫ Servicenow Version rome Update patch_3_hotfix_1
Servicenow ≫ Servicenow Version rome Update patch_4
Servicenow ≫ Servicenow Version rome Update patch_4_hotfix_1
Servicenow ≫ Servicenow Version rome Update patch_4_hotfix_1a
Servicenow ≫ Servicenow Version rome Update patch_4_hotfix_1b
Servicenow ≫ Servicenow Version rome Update patch_5
Servicenow ≫ Servicenow Version rome Update patch_5_hotfix_1
Servicenow ≫ Servicenow Version rome Update patch_5_hotfix_2
Servicenow ≫ Servicenow Version rome Update patch_6
Servicenow ≫ Servicenow Version rome Update patch_6_hotfix_1
Servicenow ≫ Servicenow Version rome Update patch_6_hotfix_2
Servicenow ≫ Servicenow Version rome Update patch_7
Servicenow ≫ Servicenow Version rome Update patch_7_hotfix_1
Servicenow ≫ Servicenow Version rome Update patch_7a
Servicenow ≫ Servicenow Version rome Update patch_7b
Servicenow ≫ Servicenow Version rome Update patch_8
Servicenow ≫ Servicenow Version rome Update patch_8_hotfix_1
Servicenow ≫ Servicenow Version rome Update patch_8_hotfix_2
Servicenow ≫ Servicenow Version rome Update patch_9
Servicenow ≫ Servicenow Version rome Update patch_9_hotfix_1
Servicenow ≫ Servicenow Version rome Update patch_9a
Servicenow ≫ Servicenow Version rome Update patch_9b
Servicenow ≫ Servicenow Version san_diego Update patch_1
Servicenow ≫ Servicenow Version san_diego Update patch_1_hotfix_1
Servicenow ≫ Servicenow Version san_diego Update patch_1_hotfix_1a
Servicenow ≫ Servicenow Version san_diego Update patch_1_hotfix_1b
Servicenow ≫ Servicenow Version san_diego Update patch_10_hotfix_1
Servicenow ≫ Servicenow Version san_diego Update patch_10_hotfix_1a
Servicenow ≫ Servicenow Version san_diego Update patch_10_hotfix_1b
Servicenow ≫ Servicenow Version san_diego Update patch_10_hotfix_2
Servicenow ≫ Servicenow Version san_diego Update patch_10_hotfix_2b
Servicenow ≫ Servicenow Version san_diego Update patch_2
Servicenow ≫ Servicenow Version san_diego Update patch_2_hotfix_1
Servicenow ≫ Servicenow Version san_diego Update patch_3
Servicenow ≫ Servicenow Version san_diego Update patch_3_hotfix_1
Servicenow ≫ Servicenow Version san_diego Update patch_3_hotfix_2
Servicenow ≫ Servicenow Version san_diego Update patch_3_hotfix_3
Servicenow ≫ Servicenow Version san_diego Update patch_3_hotfix_4
Servicenow ≫ Servicenow Version san_diego Update patch_4
Servicenow ≫ Servicenow Version san_diego Update patch_4a
Servicenow ≫ Servicenow Version san_diego Update patch_4b
Servicenow ≫ Servicenow Version san_diego Update patch_5
Servicenow ≫ Servicenow Version san_diego Update patch_6
Servicenow ≫ Servicenow Version tokyo Update -
Servicenow ≫ Servicenow Version utah Update -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.8% 0.756
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
psirt@servicenow.com 9.9 3.1 6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CWE-668 Exposure of Resource to Wrong Sphere

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

http://packetstormsecurity.com/files/173354/ServiceNow-Insecure-Access-Control-Full-Admin-Compromise.html
http://seclists.org/fulldisclosure/2023/Jul/11
https://news.ycombinator.com/item?id=36638530
https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1303489
Vendor Advisory
https://x64.sh/posts/ServiceNow-Insecure-access-control-to-admin/