CVE-2022-39048

MEDIUMNuclei

Cross-Site Scripting (XSS) vulnerability in ServiceNow UI page assessment_redirect

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-39048 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

A XSS vulnerability was identified in the ServiceNow UI page assessment_redirect. To exploit this vulnerability, an attacker would need to persuade an authenticated user to click a maliciously crafted URL. Successful exploitation potentially could be used to conduct various client-side attacks, including, but not limited to, phishing, redirection, theft of CSRF tokens, and use of an authenticated user's browser or session to attack other systems.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 7, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Now Platform

Browse Servicenow / Now Platform

Default status: unaffected

CVE ListTokyo to < Patch 1aaffected
San Diego to < Patch 7baffected
Rome to < Patch 10 Hotfix 2baffected
Quebec to < Patch 10 Hotfix 10baffected

Nuclei templates

1
ProjectDiscoveryMEDIUMServiceNow - Cross-site ScriptingCVSS 6.1

A XSS vulnerability was identified in the ServiceNow UI page assessment_redirect. To exploit this vulnerability, an attacker would need to persuade an authenticated user to click a maliciously crafted URL. Successful exploitation potentially could be used to conduct various client-side attacks, including, but not limited to, phishing, redirection, theft of CSRF tokens, and use of an authenticated user's browser or session to attack other systems.

Impact

Authenticated attackers can craft malicious URLs with JavaScript in the sysparm_survey_url parameter that executes when victims click the link, potentially stealing CSRF tokens, session cookies, or conducting phishing attacks to compromise ServiceNow authenticated users.

Remediation

Update ServiceNow to the latest patched version that properly sanitizes the sysparm_survey_url parameter in assessment_redirect.do.

WeaknessesCWE-79
Authorstheamanrawat
Template tagscvecve2022xssservicenowauthenticatedvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:servicenow:servicenow:quebec:-:*:*:*:*:*:*
Shodan: http.title:"ServiceNow"
Shodan: http.title:"servicenow"
Shodan: http.favicon.hash:1701804003
FOFA: title="servicenow"
FOFA: icon_hash=1701804003
Google: intitle:"servicenow"
https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1221892 https://blog.amanrawat.in/2023/05/05/CVE-2022-39048.html https://nvd.nist.gov/vuln/detail/CVE-2022-39048 https://support.servicenow.com/

Source: ProjectDiscovery

References

3