Description
There exists an open redirect within the response list update functionality of ServiceNow. This allows attackers to redirect users to arbitrary domains when clicking on a URL within a service-now domain.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ServiceNow | ServiceNow | Tokyo – < Tokyo Patch 1b, San Diego – < San Diego Patch 7b, Rome – < Rome Patch 10 Hotfix 2b, Quebec – < Quebec Patch 10 Hotfix 10b | Tokyo Patch 1b |