VYPR
← All advisories
Medium severity6.1NVD Advisory· Published Apr 17, 2023· Updated Jun 17, 2026

CVE-2022-46389

CVE-2022-46389

Description

There exists a reflected XSS within the logout functionality of ServiceNow versions lower than Quebec Patch 10 Hotfix 11b, Rome Patch 10 Hotfix 3b, San Diego Patch 9, Tokyo Patch 4, and Utah GA. This enables an unauthenticated remote attacker to execute arbitrary JavaScript code in the browser-based web console.

Affected products

49
  • Servicenow/Servicenow48 versions
    cpe:2.3:a:servicenow:servicenow:quebec:-:*:*:*:*:*:*+ 47 more
    • cpe:2.3:a:servicenow:servicenow:quebec:-:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:rome:-:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:rome:early_availability:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:rome:patch_10:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:rome:patch_1:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_1a:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_1b:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:rome:patch_2:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:rome:patch_3:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:rome:patch_4:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:rome:patch_4_hotfix_1:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:rome:patch_4_hotfix_1a:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:rome:patch_4_hotfix_1b:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:rome:patch_5:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:rome:patch_6:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:rome:patch_7:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:rome:patch_7a:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:rome:patch_7b:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:rome:patch_8:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:rome:patch_9:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:rome:patch_9a:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:san_diego:-:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:san_diego:patch_1:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1a:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1b:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:san_diego:patch_2:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:san_diego:patch_3:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:san_diego:patch_4:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:san_diego:patch_4a:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:san_diego:patch_4b:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:san_diego:patch_5:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:san_diego:patch_6:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:san_diego:patch_7:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:san_diego:patch_7b:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:san_diego:patch_8:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:tokyo:-:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:tokyo:early_availability:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:tokyo:patch_1:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:tokyo:patch_1a:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:tokyo:patch_1b:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:tokyo:patch_2:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:tokyo:patch_3:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:utah:-:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:utah:early_availability:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:utah:patch_1:*:*:*:*:*:*
    • cpe:2.3:a:servicenow:servicenow:utah:patch_2:*:*:*:*:*:*
    • (no CPE)range: <Quebec Patch 10 Hotfix 11b, <Rome Patch 10 Hotfix 3b, <San Diego Patch 9, <Tokyo Patch 4, <Utah GA
  • Servicenow/Now Platformv5
    Range: Quebec

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.