[Security Advisory] CVE-2022-46389 - Cross-Site Scripting (XSS) vulnerability found on logout functionality - Security

[Security Advisory] CVE-2022-46389 - Cross-Site Scripting (XSS) vulnerability found on logout functionality  ServiceNow Posture April, 2023 Description

In September 2022, ServiceNow announced the release of patches addressing a cross-site scripting (XSS) vulnerability in ServiceNow's logout functionality. That vulnerability was designated as CVE-2022-38463 . A vulnerability has been identified that bypasses the fixes for CVE-2022-38463, and ServiceNow has released patches that address this issue, which has been designated as CVE-2022-46389.

Additional Details

This vulnerability is present in the following supported ServiceNow releases:

Tokyo prior to Tokyo Patch 4; and Utah prior to Utah GA The Quebec release prior to Quebec Patch 10 Hotfix 11b, the Rome release prior to Rome Patch 10 Hotfix 3b, and the San Diego release prior to San Diego Patch 9 also are known to be affected.

To exploit CVE-2022-46389, an attacker would need to persuade an authenticated user to click a maliciously crafted URL. A successful attack could allow an unauthenticated, remote attacker to execute arbitrary JavaScript code in the browser-based web console.

Resolution

This vulnerability has been addressed in the releases and patches listed in the table below. Customers can view their patching schedules via the Maintenance Calendar.

Release Fixed Versions Quebec Quebec Patch 10 Hotfix 11b Rome Rome Patch 10 Hotfix 3b San Diego San Diego Patch 9 Tokyo Tokyo Patch 4 Utah Utah GA For customers with instances still using a version of ServiceNow in which the vulnerability is present, ServiceNow recommends applying the appropriate upgrade or patch to those instances as soon as possible. Customers can adjust their patch schedules by selecting the Reschedule Action dropdown.

For customers who require technical assistance with this issue, please contact ServiceNow Technical Support.

Resources ServiceNow does not endorse or share the views, positions, or claims expressed by any of the following links. They are provided solely as supplementary material.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-46389 Change Log

Version Published Summary of Changes 1.0 April 5, 2023 Initial publication 2.0 April 7, 2023 Clarified affected versions