[Security Advisory] CVE-2022-46886 - Open Redirect vulnerability found on response list update functionality - Security

[Security Advisory] CVE-2022-46886 - Open Redirect vulnerability found on response list update functionality  ServiceNow Posture April 2023 Description

ServiceNow has released patches that address an open redirect vulnerability that was identified in ServiceNow's response list update functionality.

Additional Details

This vulnerability is present in the following supported ServiceNow release:

Tokyo prior to Tokyo Patch 1b and Patch 3 The Quebec release prior to Patch 10 Hotfix 10b, the Rome release prior to Rome Patch 10 Hotfix 2b and Hotfix 3b, and the San Diego release prior to San Diego Patch 7b and Patch 9 also are known to be affected.

Successful exploitation of this vulnerability potentially could be used to facilitate targeted attacks such as phishing. For example, CVE-2022-46886 may enable attackers to redirect authenticated users to domains the attackers control and cause the disclosure of sensitive information, like login credentials.

Resolution

This vulnerability has been addressed in the patches listed in the table below. Customers can view their patching schedules via the Maintenance Calendar.

Release Fixed Version Utah All Versions Tokyo Patch 1b and Patch 3 San Diego Patch 7b and Patch 9 Rome Patch 10 HotFix 2b and HotFix 3b Quebec Patch 10 HotFix 10b

For customers with instances still using a version of ServiceNow in which the vulnerability is present, ServiceNow recommends applying the appropriate patch to those instances as soon as possible. Customers can adjust their patch schedules by selecting the Reschedule Action dropdown.

References

ServiceNow does not endorse or share the views, positions, or claims expressed by any of the following links. They are provided solely as supplementary material.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-46886 Change Log

Version Published Summary of Changes 1.0 April 5, 2023 Initial publication 2.0 April 7, 2023 Clarified affected versions