CVE-2023-1298 - Cross-Site Scripting (XSS) vulnerability in the NOW User Experience

ServiceNow Posture July 2023 Description

ServiceNow has released upgrades and patches that address a Reflected Cross-Site scripting (XSS) vulnerability that was identified in the ServiceNow Polaris Layout. This vulnerability would enable an authenticated user to inject arbitrary scripts.

Additional Details

This vulnerability is present in the following supported ServiceNow releases:

San Diego prior to San Diego Patch 10 Tokyo prior to Tokyo Patch 4b and Patch 6 Utah Patch 1 Resolution

This vulnerability has been addressed in the releases and patches listed in the table below. Customers can view their patching schedules via the Maintenance Calendar.

Release Fixed Version San Diego Patch 10 Tokyo Patch 4b and Patch 6 Utah Patch 2, Patch 1 Hotfix 1a* and Utah Patch 1 Hotfix 1b *Utah Patch 1 Hotfix 1a has been retired and replaced with Utah Patch 1 Hotfix 1b.

For customers with instances still using a version of ServiceNow in which the vulnerability is present, ServiceNow recommends applying the appropriate upgrade or patch to those instances as soon as possible. Customers can adjust their patch schedules by selecting the Reschedule Action dropdown.

For customers who require technical assistance with this issue, please contact ServiceNow Technical Support.

Additional Resources https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1298 Change Log

Version Published Summary of Changes 1.0 July 06, 2023 Initial publication