There exists an open redirect within the response list update functionality of ServiceNow. This allows attackers to redirect users to arbitrary domains when clicking on a URL within a service-now domain.
References
| Link | Resource |
|---|---|
| https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1219857 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
24 Apr 2023, 17:39
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
| CPE | cpe:2.3:a:servicenow:servicenow:san_diego:patch_6:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:rome:patch_5:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:rome:patch_4_hotfix_1:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:san_diego:patch_2_hotfix_1:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:san_diego:patch_4a:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:rome:patch_8_hotfix_1:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:rome:patch_10_hotfix_1:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:san_diego:patch_3:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:tokyo:patch1:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:rome:patch_7b:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:rome:patch_6_hotfix_1:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:rome:patch_9:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1a:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:rome:patch_9b:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:san_diego:patch_2:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:rome:patch_2:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:rome:patch_8:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_4:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:san_diego:patch_7:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:rome:patch_1:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:rome:patch_9a:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:tokyo:-:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_2:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_3:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_2:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:rome:patch_2_hotfix_2:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:san_diego:patch_4b:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:san_diego:patch_1:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:rome:patch_8_hotfix_2:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:rome:patch_2_hotfix_1:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:rome:patch_10_hotfix_2a:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:rome:patch_10_hotfix_2:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:rome:patch_4_hotfix_1b:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:rome:patch_5_hotfix_2:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:rome:patch_6:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:rome:patch_3:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_3:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:san_diego:patch_8:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:quebec:-:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:san_diego:patch_4:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:quebec:patch_10:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:rome:patch_5_hotfix_1:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:rome:patch_7:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:rome:patch_7_hotfix_1:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_1:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:rome:patch_10:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:rome:patch_4:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_1:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:rome:patch_7a:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:rome:patch_4_hotfix_1a:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:rome:patch_9_hotfix_1:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:rome:patch_6_hotfix_2:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:rome:patch_3_hotfix_1:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_1b:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1b:*:*:*:*:*:* |
|
| References | (MISC) https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1219857 - Vendor Advisory | |
| CWE | CWE-601 |
17 Apr 2023, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-04-14 20:15
Updated : 2024-02-04 23:37
NVD link : CVE-2022-46886
Mitre link : CVE-2022-46886
CVE.ORG link : CVE-2022-46886
JSON object : View
Products Affected
servicenow
- servicenow
CWE
CWE-601
URL Redirection to Untrusted Site ('Open Redirect')