CVE-2022-46389

servicenow

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2022-46389

Katalog CVE

CVSS 6.1 · Medium EPSS 0,60%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada servicenow. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

There exists a reflected XSS within the logout functionality of ServiceNow versions lower than Quebec Patch 10 Hotfix 11b, Rome Patch 10 Hotfix 3b, San Diego Patch 9, Tokyo Patch 4, and Utah GA. This enables an unauthenticated remote attacker to execute arbitrary JavaScript code in the browser-based web console.

Rincian

Terbit di NVD
17 April 2023
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
EPSS (30 hari)
0,60% peluang dieksploitasi; lebih tinggi dari 47,0% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
servicenow servicenow Versi quebec
servicenow servicenow Versi rome
servicenow servicenow Versi rome early_availability
servicenow servicenow Versi rome patch_1
servicenow servicenow Versi rome patch_1_hotfix_1a
servicenow servicenow Versi rome patch_1_hotfix_1b
servicenow servicenow Versi rome patch_10
servicenow servicenow Versi rome patch_2
servicenow servicenow Versi rome patch_3
servicenow servicenow Versi rome patch_4
servicenow servicenow Versi rome patch_4_hotfix_1
servicenow servicenow Versi rome patch_4_hotfix_1a
servicenow servicenow Versi rome patch_4_hotfix_1b
servicenow servicenow Versi rome patch_5
servicenow servicenow Versi rome patch_6
servicenow servicenow Versi rome patch_7
servicenow servicenow Versi rome patch_7a
servicenow servicenow Versi rome patch_7b
servicenow servicenow Versi rome patch_8
servicenow servicenow Versi rome patch_9
servicenow servicenow Versi rome patch_9a
servicenow servicenow Versi san_diego
servicenow servicenow Versi san_diego patch_1
servicenow servicenow Versi san_diego patch_1_hotfix_1
servicenow servicenow Versi san_diego patch_1_hotfix_1a
servicenow servicenow Versi san_diego patch_1_hotfix_1b
servicenow servicenow Versi san_diego patch_2
servicenow servicenow Versi san_diego patch_3
servicenow servicenow Versi san_diego patch_4
servicenow servicenow Versi san_diego patch_4a
servicenow servicenow Versi san_diego patch_4b
servicenow servicenow Versi san_diego patch_5
servicenow servicenow Versi san_diego patch_6
servicenow servicenow Versi san_diego patch_7
servicenow servicenow Versi san_diego patch_7b
servicenow servicenow Versi san_diego patch_8
servicenow servicenow Versi tokyo
servicenow servicenow Versi tokyo early_availability
servicenow servicenow Versi tokyo patch_1
servicenow servicenow Versi tokyo patch_1a
servicenow servicenow Versi tokyo patch_1b
servicenow servicenow Versi tokyo patch_2
servicenow servicenow Versi tokyo patch_3
servicenow servicenow Versi utah
servicenow servicenow Versi utah early_availability
servicenow servicenow Versi utah patch_1
servicenow servicenow Versi utah patch_2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.