Log in Start free

Vulnerability · Published Jun 13, 2023 · Assigned by SN

CVE-2022-43684ACL bypass in Reporting functionality

Critical 9.9

In plain English

A critical-severity information exposure in Now Platform from ServiceNow. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities).

Severity (CVSS 3.1)9.9Critical
Exploit odds (30 days)1.8%top 21.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

ServiceNow has released patches and an upgrade that address an Access Control List (ACL) bypass issue in ServiceNow Core functionality. Additional Details This issue is present in the following supported ServiceNow releases: * Quebec prior to Patch 10 Hot Fix 8b * Rome prior to Patch 10 Hot Fix 1 * San Diego prior to Patch 7 * Tokyo prior to Tokyo Patch 1; and * Utah prior to Utah General Availability If this ACL bypass issue were to be successfully exploited, it potentially could allow an authenticated user to obtain sensitive information from tables missing authorization controls.

Affected products (as reported)

VendorProductVersions
ServiceNow Now Platform Quebec – before Patch 10 Hot Fix 8bRome – before Patch 10 Hot Fix 1San Diego – before Patch 7Tokyo – before Tokyo Patch 1Utah – before Utah General Availability (GA)

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References