CVE-2022-39048

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-39048
A XSS vulnerability was identified in the ServiceNow UI page assessment_redirect. To exploit this vulnerability, an attacker would need to persuade an authenticated user to click a maliciously crafted URL. Successful exploitation potentially could be used to conduct various client-side attacks, including, but not limited to, phishing, redirection, theft of CSRF tokens, and use of an authenticated user's browser or session to attack other systems.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://support.servicenow.com/
https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1221892
https://support.servicenow.com/
https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1221892
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:servicenow:servicenow:quebec:-:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:quebec:patch_10:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_1b:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_2:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_3:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_10:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_10_hotfix_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_10_hotfix_2:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_10_hotfix_2a:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_2:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_2_hotfix_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_2_hotfix_2:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_3:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_3_hotfix_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_4:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_4_hotfix_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_4_hotfix_1a:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_4_hotfix_1b:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_5:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_5_hotfix_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_5_hotfix_2:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_6:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_6_hotfix_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_6_hotfix_2:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_7:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_7_hotfix_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_7a:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_7b:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_8:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_8_hotfix_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_8_hotfix_2:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_9:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_9_hotfix_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_9a:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_9b:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:san_diego:patch_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1a:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1b:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:san_diego:patch_2:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:san_diego:patch_2_hotfix_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:san_diego:patch_3:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_2:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_3:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_4:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:san_diego:patch_4:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:san_diego:patch_4a:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:san_diego:patch_4b:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:san_diego:patch_6:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:san_diego:patch_7:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:san_diego:patch_8:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:tokyo:-:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:tokyo:patch1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:utah:-:*:*:*:*:*:*
History

21 Nov 2024, 07:17

Type Values Removed Values Added
References () https://support.servicenow.com/ - () https://support.servicenow.com/ -
References () https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1221892 - () https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1221892 -

07 Nov 2023, 03:50

Type Values Removed Values Added
References (MISC) https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1221892 - Vendor Advisory () https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1221892 -
References (MISC) https://support.servicenow.com/ - () https://support.servicenow.com/ -

18 Apr 2023, 16:15

Type Values Removed Values Added
References
  • (MISC) https://support.servicenow.com/ -

18 Apr 2023, 00:15

Type Values Removed Values Added
Summary XSS vulnerability that was identified in the ServiceNow UI page assessment_redirect.To exploit this vulnerability, an attacker would need to persuade an authenticated user to click a maliciously crafted URL. Successful exploitation potentially could be used to conduct various client-side attacks, including, but not limited to, phishing, redirection, theft of CSRF tokens, and using an authenticated user's browser or session to attack other systems A XSS vulnerability was identified in the ServiceNow UI page assessment_redirect. To exploit this vulnerability, an attacker would need to persuade an authenticated user to click a maliciously crafted URL. Successful exploitation potentially could be used to conduct various client-side attacks, including, but not limited to, phishing, redirection, theft of CSRF tokens, and use of an authenticated user's browser or session to attack other systems.

17 Apr 2023, 22:15

Type Values Removed Values Added
References
  • {'url': 'https://support.servicenow.com', 'name': 'https://support.servicenow.com', 'tags': ['Product'], 'refsource': 'MISC'}
Summary ServiceNow Tokyo allows XSS. XSS vulnerability that was identified in the ServiceNow UI page assessment_redirect.To exploit this vulnerability, an attacker would need to persuade an authenticated user to click a maliciously crafted URL. Successful exploitation potentially could be used to conduct various client-side attacks, including, but not limited to, phishing, redirection, theft of CSRF tokens, and using an authenticated user's browser or session to attack other systems

14 Apr 2023, 15:20

Type Values Removed Values Added
CWE CWE-79
References (MISC) https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1221892 - (MISC) https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1221892 - Vendor Advisory
References (MISC) https://support.servicenow.com - (MISC) https://support.servicenow.com - Product
First Time Servicenow servicenow
Servicenow
CPE cpe:2.3:a:servicenow:servicenow:san_diego:patch_6:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_6:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_7a:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_10_hotfix_2:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:san_diego:patch_3:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_4:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:san_diego:patch_4b:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_8_hotfix_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_2:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_10_hotfix_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_7:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_3:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_3:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_9_hotfix_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_9:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_5_hotfix_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_4_hotfix_1b:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_7_hotfix_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_2:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_1b:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_6_hotfix_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:tokyo:-:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_4_hotfix_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1b:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_4:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:quebec:-:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:san_diego:patch_4:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:san_diego:patch_2_hotfix_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_10:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:tokyo:patch1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_9b:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_8:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1a:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:san_diego:patch_2:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:utah:-:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_2_hotfix_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:san_diego:patch_4a:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_6_hotfix_2:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:san_diego:patch_7:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:san_diego:patch_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_4_hotfix_1a:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_8_hotfix_2:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_5:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:san_diego:patch_8:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_10_hotfix_2a:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_3_hotfix_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_1:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_2:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_2_hotfix_2:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_9a:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_5_hotfix_2:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:quebec:patch_10:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_7b:*:*:*:*:*:*
cpe:2.3:a:servicenow:servicenow:rome:patch_3:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.1

10 Apr 2023, 14:16

Type Values Removed Values Added
New CVE
Information

Published : 2023-04-10 14:15

Updated : 2025-02-07 21:15

NVD link : CVE-2022-39048

Mitre link : CVE-2022-39048

CVE.ORG link : CVE-2022-39048

JSON object : View

Products Affected

servicenow

  • servicenow
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')