Description
A XSS vulnerability was identified in the ServiceNow UI page assessment_redirect. To exploit this vulnerability, an attacker would need to persuade an authenticated user to click a maliciously crafted URL. Successful exploitation potentially could be used to conduct various client-side attacks, including, but not limited to, phishing, redirection, theft of CSRF tokens, and use of an authenticated user's browser or session to attack other systems.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Servicenow | Now Platform | Tokyo – < Patch 1a, San Diego – < Patch 7b, Rome – < Patch 10 Hotfix 2b, Quebec – < Patch 10 Hotfix 10b | Patch 1a |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- ServiceNow - Cross-site Scripting http/cves/2022/CVE-2022-39048.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.