[Security Advisory] CVE-2022-39048 - Cross-Site Scripting Vulnerability in Assessments - Security

[Security Advisory] CVE-2022-39048 - Cross-Site Scripting Vulnerability in Assessments  ServiceNow Posture April 2023 Description

ServiceNow has released upgrades and patches that address a cross-site scripting (XSS) vulnerability that was identified in the ServiceNow UI page assessment_redirect.

Additional Details

This vulnerability is present in the following supported ServiceNow releases:

Tokyo prior to Tokyo Patch 1a and Patch 2; and Utah prior to Utah GA The Quebec release prior to Quebec Patch 10 Hotfix 10b, Rome release prior to Rome Patch 10 Hotfix 2b, and San Diego release prior to San Diego Patch 7b and Patch 9 also are known to be affected.

To exploit this vulnerability, an attacker would need to persuade an authenticated user to click a maliciously crafted URL. Successful exploitation potentially could be used to conduct various client-side attacks, including, but not limited to, phishing, redirection, theft of CSRF tokens, and using an authenticated user's browser or session to attack other systems.

Resolution

This vulnerability has been addressed in the releases and patches listed in the table below. Customers can view their patching schedules via the Maintenance Calendar.

Release Fixed Version Utah GA Version Tokyo Patch 1a and Patch 2 San Diego Patch 7b and Patch 9 Rome Patch 10 HotFix 2b Quebec Patch 10 HotFix 10b

For customers with instances still using a version of ServiceNow in which the vulnerability is present, ServiceNow recommends applying the appropriate upgrade or patch to those instances as soon as possible. Customers can adjust their patch schedules by selecting the Reschedule Action dropdown.

For customers who require technical assistance with this issue, please contact ServiceNow Technical Support.

Resources ServiceNow does not endorse or share the views, positions, or claims expressed by any of the following links. They are provided solely as supplementary material.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39048 Change Log

Version Published Summary of Changes 1.0 April 5, 2023 Initial publication 2.0 April 7, 2023 Clarified affected versions 3.0 April 7, 2023 Clarified fixed versions for the Utah release