CVE-2022-46389

Cross-Site Scripting (XSS) vulnerability found on logout functionality

State: Published
Severity: 6.1 Medium
Published: Apr 17, 2023
Updated: Feb 6, 2025
Reserved: Dec 4, 2022

Description

There exists a reflected XSS within the logout functionality of ServiceNow versions lower than Quebec Patch 10 Hotfix 11b, Rome Patch 10 Hotfix 3b, San Diego Patch 9, Tokyo Patch 4, and Utah GA. This enables an unauthenticated remote attacker to execute arbitrary JavaScript code in the browser-based web console.

Scores

CVSS	Score	Vector	Source
3.1	6.1 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	SN

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
Now PlatformServiceNow	Quebec to before Patch 10 Hotfix 11bAffected Rome to before Patch 10 Hotfix 3bAffected San Diego to before Patch 9Affected Tokyo to before Patch 4Affected Utah to before GAAffected

References

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1272156

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.