[Security Advisory] CVE-2022-42704 - Cross-Site Scripting in Service Catalog Widget - Security

[Security Advisory] CVE-2022-42704 - Cross-Site Scripting in Service Catalog Widget  ServiceNow Posture January, 2023 A Cross-Site Scripting (XSS) vulnerability has been discovered and subsequently patched by ServiceNow. There is a stored XSS vulnerability within the "Standard Ticket Conversations" widget in the ServiceNow platform. This vulnerability enables attackers with access to the affected widget to submit arbitrary javascript that is executed by other users who access the affected resource later.

The best practice to remediate this issue is to upgrade your instance with the patch as soon as possible AND ensure any customizations to that widget have been reverted.

This issue affects ServiceNow versions prior to Rome Patch 5 and San Diego Patch 1.

This issue has been fixed in these versions and below:

Release Impacted Versions Fixed Versions Quebec All Versions QP10HF3b Rome Versions prior to RP5 RP7b and RP9 San Diego Versions prior to SP1 SP1HF1b and SP3 Tokyo N/A Tokyo If you have further questions regarding this issue, please submit a Support Case.

Additional Resources For more information, please visit KB1196914 (NowSupport login required)

ServiceNow does not endorse or share the views, positions, or claims expressed by any of the following links. They are provided solely as supplementary material.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42704