CVE-2022-46389: Cross-Site Scripting (XSS) vulnerability…

Record summary

CVE-2022-46389 has a selected CVSS score of 6.1 (medium).

Description

There exists a reflected XSS within the logout functionality of ServiceNow versions lower than Quebec Patch 10 Hotfix 11b, Rome Patch 10 Hotfix 3b, San Diego Patch 9, Tokyo Patch 4, and Utah GA. This enables an unauthenticated remote attacker to execute arbitrary JavaScript code in the browser-based web console.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone

AutomatableNo

Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 6, 2025 · Source: CVE List

Affected products and versions

Product	Source	Version range	Status
Now Platform Browse ServiceNow / Now Platform	CVE List	Quebec to < Patch 10 Hotfix 11b	affected
		Rome to < Patch 10 Hotfix 3b	affected
		San Diego to < Patch 9	affected
		Tokyo to < Patch 4	affected
		Utah to < GA	affected

References

nvd.nist.gov

https://nvd.nist.gov/vuln/detail/CVE-2022-46389

support.servicenow.com

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1272156