CVE-2023-1298

State: Published
Severity: 4.3 Medium
Published: Jul 6, 2023
Updated: Oct 21, 2024
Reserved: Mar 9, 2023

Description

ServiceNow has released upgrades and patches that address a Reflected Cross-Site scripting (XSS) vulnerability that was identified in the ServiceNow Polaris Layout. This vulnerability would enable an authenticated user to inject arbitrary scripts.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N	SN

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
Now User ExperienceServiceNow	before San Diego Patch 10Affected before Tokyo Patch 4bAffected before Tokyo Patch 6Affected before Utah Patch 1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.