[Security Advisory] CVE-2023-1209 - Reflected Cross Site Scripting (XSS) in Records - Security

[Security Advisory] CVE-2023-1209 - Reflected Cross Site Scripting (XSS) in Records  ServiceNow Posture May 2023

Description

ServiceNow has released patches that address reflected Cross Site Scripting (XSS) vulnerabilities that were identified in ServiceNow records.

Additional Details

These vulnerabilities are present in the following supported ServiceNow releases:

Tokyo prior to Tokyo Patch 4a and Patch 5; and Utah prior to Utah Patch 1 The Rome release before Rome Patch 10 Hotfix 4b and San Diego release prior to San Diego Patch 9a and Patch 10 also are known to be affected.

Successful exploitation of these vulnerabilities potentially could allow the injection of arbitrary scripts.

Resolution

These vulnerabilities have been addressed in the releases and patches listed in the table below.

Customers can view their patching schedules via the Maintenance Calendar.

Release Fixed Version Rome Patch 10 Hotfix 4b San Diego Patch 9a and Patch 10 Tokyo Patch 4a and Patch 5 Utah Patch 1

For customers with instances still using a version of ServiceNow in which the vulnerabilities are present, ServiceNow recommends applying the appropriate upgrade or patch to those instances as soon as possible. Customers can adjust their patch schedules by selecting the Reschedule Action dropdown.

For customers who require technical assistance with this issue, please contact ServiceNow Technical Support.

Resources ServiceNow does not endorse or share the views, positions, or claims expressed by any of the following links. They are provided solely as supplementary material.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=2023-1209 Change Log

Version Published Summary of Changes 1.0 May 23, 2023 Initial publication