CVE-2022-46886

State: Published
Severity: 5.5 Medium
Published: Apr 14, 2023
Updated: Feb 6, 2025
Reserved: Dec 9, 2022

Description

There exists an open redirect within the response list update functionality of ServiceNow. This allows attackers to redirect users to arbitrary domains when clicking on a URL within a service-now domain.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L	SN

Weaknesses

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

Affected Products

Product	Versions
ServiceNowServiceNow	Tokyo to before Tokyo Patch 1bAffectedfrom Tokyo Patch 3Not affected San Diego to before San Diego Patch 7bAffectedfrom San Diego Patch 9Not affected Rome to before Rome Patch 10 Hotfix 2bAffectedfrom Rome Patch 10 Hotfix 3bNot affected Quebec to before Quebec Patch 10 Hotfix 10bAffected

References

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1219857

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.