CVE-2023-1298 | THREATINT

Description

ServiceNow has released upgrades and patches that address a Reflected Cross-Site scripting (XSS) vulnerability that was identified in the ServiceNow Polaris Layout. This vulnerability would enable an authenticated user to inject arbitrary scripts.

PUBLISHED Reserved 2023-03-09 | Published 2023-07-06 | Updated 2024-10-21 | Assigner SN

MEDIUM: 4.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

Default status

unaffected

Any version before San Diego Patch 10

affected

Any version before Tokyo Patch 4b

affected

Any version before Tokyo Patch 6

affected

Any version before Utah Patch 1

affected

Credits

Osama Yousef finder

References

support.servicenow.com/...cle_view&sysparm_article=KB1310230 vendor-advisory

www.linkedin.com/in/osamay/

support.servicenow.com/...cle_view&sysparm_article=KB1310230 vendor-advisory

www.linkedin.com/in/osamay/

cve.org (CVE-2023-1298)

nvd.nist.gov (CVE-2023-1298)

Download JSON