Read the docs
TI-2019-14988 Aliases CVE-2019-20768GHSA-pw7g-7762-p5qw

ServiceNow IT Service Management Kingston through Patch 14-1, London through Patch 7, and…

Priority LOW 26CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

ServiceNow IT Service Management Kingston through Patch 14-1, London through Patch 7, and Madrid before patch 4 allow stored XSS via crafted sysparm_item_guid and sys_id parameters in an Incident Request to service_catalog.do.

Why it matters now

EPSS 0.00719 54th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 66

CPEVersionsRoleVendor
cpe:2.3:a:servicenow:it_service_management:kingston:-:*:*:*:*:*:*kingstonVulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:kingston:patch_1:*:*:*:*:*:*kingston patch_1VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:kingston:patch_10:*:*:*:*:*:*kingston patch_10VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:kingston:patch_10-1:*:*:*:*:*:*kingston patch_10-1VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:kingston:patch_10-2:*:*:*:*:*:*kingston patch_10-2VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:kingston:patch_11:*:*:*:*:*:*kingston patch_11VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:kingston:patch_12:*:*:*:*:*:*kingston patch_12VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:kingston:patch_12-1:*:*:*:*:*:*kingston patch_12-1VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:kingston:patch_12-2:*:*:*:*:*:*kingston patch_12-2VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:kingston:patch_13:*:*:*:*:*:*kingston patch_13VulnerableServiceNow
  • cpe:2.3:a:servicenow:it_service_management:kingston:-:*:*:*:*:*:* Versions kingston Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:kingston:patch_1:*:*:*:*:*:* Versions kingston patch_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:kingston:patch_10:*:*:*:*:*:* Versions kingston patch_10 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:kingston:patch_10-1:*:*:*:*:*:* Versions kingston patch_10-1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:kingston:patch_10-2:*:*:*:*:*:* Versions kingston patch_10-2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:kingston:patch_11:*:*:*:*:*:* Versions kingston patch_11 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:kingston:patch_12:*:*:*:*:*:* Versions kingston patch_12 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:kingston:patch_12-1:*:*:*:*:*:* Versions kingston patch_12-1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:kingston:patch_12-2:*:*:*:*:*:* Versions kingston patch_12-2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:kingston:patch_13:*:*:*:*:*:* Versions kingston patch_13 Vulnerable ·ServiceNow
Show 56 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:servicenow:it_service_management:kingston:patch_14:*:*:*:*:*:*kingston patch_14VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:kingston:patch_14-1:*:*:*:*:*:*kingston patch_14-1VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:kingston:patch_2:*:*:*:*:*:*kingston patch_2VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:kingston:patch_3:*:*:*:*:*:*kingston patch_3VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:kingston:patch_3-1:*:*:*:*:*:*kingston patch_3-1VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:kingston:patch_3-2:*:*:*:*:*:*kingston patch_3-2VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:kingston:patch_3a-1:*:*:*:*:*:*kingston patch_3a-1VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:kingston:patch_4:*:*:*:*:*:*kingston patch_4VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:kingston:patch_4-1:*:*:*:*:*:*kingston patch_4-1VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:kingston:patch_4-2:*:*:*:*:*:*kingston patch_4-2VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:kingston:patch_4-4:*:*:*:*:*:*kingston patch_4-4VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:kingston:patch_5:*:*:*:*:*:*kingston patch_5VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:kingston:patch_6:*:*:*:*:*:*kingston patch_6VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:kingston:patch_6-1:*:*:*:*:*:*kingston patch_6-1VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:kingston:patch_6-2:*:*:*:*:*:*kingston patch_6-2VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:kingston:patch_6-3:*:*:*:*:*:*kingston patch_6-3VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:kingston:patch_6-5:*:*:*:*:*:*kingston patch_6-5VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:kingston:patch_7:*:*:*:*:*:*kingston patch_7VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:kingston:patch_7-1:*:*:*:*:*:*kingston patch_7-1VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:kingston:patch_8:*:*:*:*:*:*kingston patch_8VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:kingston:patch_8-1:*:*:*:*:*:*kingston patch_8-1VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:kingston:patch_9:*:*:*:*:*:*kingston patch_9VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:london:-:*:*:*:*:*:*londonVulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:london:patch_1:*:*:*:*:*:*london patch_1VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:london:patch_1-2:*:*:*:*:*:*london patch_1-2VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:london:patch_1-3:*:*:*:*:*:*london patch_1-3VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:london:patch_2:*:*:*:*:*:*london patch_2VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:london:patch_2-2:*:*:*:*:*:*london patch_2-2VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:london:patch_2-4:*:*:*:*:*:*london patch_2-4VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:london:patch_2-5:*:*:*:*:*:*london patch_2-5VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:london:patch_3:*:*:*:*:*:*london patch_3VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:london:patch_3-3:*:*:*:*:*:*london patch_3-3VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:london:patch_3-4:*:*:*:*:*:*london patch_3-4VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:london:patch_4:*:*:*:*:*:*london patch_4VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:london:patch_4-1:*:*:*:*:*:*london patch_4-1VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:london:patch_4-2:*:*:*:*:*:*london patch_4-2VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:london:patch_4-3:*:*:*:*:*:*london patch_4-3VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:london:patch_4-4:*:*:*:*:*:*london patch_4-4VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:london:patch_4-5:*:*:*:*:*:*london patch_4-5VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:london:patch_4-6:*:*:*:*:*:*london patch_4-6VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:london:patch_5:*:*:*:*:*:*london patch_5VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:london:patch_5-1:*:*:*:*:*:*london patch_5-1VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:london:patch_6:*:*:*:*:*:*london patch_6VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:london:patch_6-1:*:*:*:*:*:*london patch_6-1VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:london:patch_6a-1:*:*:*:*:*:*london patch_6a-1VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:london:patch_6b-1:*:*:*:*:*:*london patch_6b-1VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:london:patch_7:*:*:*:*:*:*london patch_7VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:madrid:-:*:*:*:*:*:*madridVulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:madrid:patch_0-1:*:*:*:*:*:*madrid patch_0-1VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:madrid:patch_1:*:*:*:*:*:*madrid patch_1VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:madrid:patch_1-1:*:*:*:*:*:*madrid patch_1-1VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:madrid:patch_1-2:*:*:*:*:*:*madrid patch_1-2VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:madrid:patch_2:*:*:*:*:*:*madrid patch_2VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:madrid:patch_3:*:*:*:*:*:*madrid patch_3VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:madrid:patch_3-1:*:*:*:*:*:*madrid patch_3-1VulnerableServiceNow
cpe:2.3:a:servicenow:it_service_management:madrid:patch_3-2:*:*:*:*:*:*madrid patch_3-2VulnerableServiceNow
  • cpe:2.3:a:servicenow:it_service_management:kingston:patch_14:*:*:*:*:*:* Versions kingston patch_14 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:kingston:patch_14-1:*:*:*:*:*:* Versions kingston patch_14-1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:kingston:patch_2:*:*:*:*:*:* Versions kingston patch_2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:kingston:patch_3:*:*:*:*:*:* Versions kingston patch_3 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:kingston:patch_3-1:*:*:*:*:*:* Versions kingston patch_3-1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:kingston:patch_3-2:*:*:*:*:*:* Versions kingston patch_3-2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:kingston:patch_3a-1:*:*:*:*:*:* Versions kingston patch_3a-1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:kingston:patch_4:*:*:*:*:*:* Versions kingston patch_4 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:kingston:patch_4-1:*:*:*:*:*:* Versions kingston patch_4-1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:kingston:patch_4-2:*:*:*:*:*:* Versions kingston patch_4-2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:kingston:patch_4-4:*:*:*:*:*:* Versions kingston patch_4-4 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:kingston:patch_5:*:*:*:*:*:* Versions kingston patch_5 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:kingston:patch_6:*:*:*:*:*:* Versions kingston patch_6 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:kingston:patch_6-1:*:*:*:*:*:* Versions kingston patch_6-1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:kingston:patch_6-2:*:*:*:*:*:* Versions kingston patch_6-2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:kingston:patch_6-3:*:*:*:*:*:* Versions kingston patch_6-3 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:kingston:patch_6-5:*:*:*:*:*:* Versions kingston patch_6-5 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:kingston:patch_7:*:*:*:*:*:* Versions kingston patch_7 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:kingston:patch_7-1:*:*:*:*:*:* Versions kingston patch_7-1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:kingston:patch_8:*:*:*:*:*:* Versions kingston patch_8 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:kingston:patch_8-1:*:*:*:*:*:* Versions kingston patch_8-1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:kingston:patch_9:*:*:*:*:*:* Versions kingston patch_9 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:london:-:*:*:*:*:*:* Versions london Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:london:patch_1:*:*:*:*:*:* Versions london patch_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:london:patch_1-2:*:*:*:*:*:* Versions london patch_1-2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:london:patch_1-3:*:*:*:*:*:* Versions london patch_1-3 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:london:patch_2:*:*:*:*:*:* Versions london patch_2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:london:patch_2-2:*:*:*:*:*:* Versions london patch_2-2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:london:patch_2-4:*:*:*:*:*:* Versions london patch_2-4 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:london:patch_2-5:*:*:*:*:*:* Versions london patch_2-5 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:london:patch_3:*:*:*:*:*:* Versions london patch_3 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:london:patch_3-3:*:*:*:*:*:* Versions london patch_3-3 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:london:patch_3-4:*:*:*:*:*:* Versions london patch_3-4 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:london:patch_4:*:*:*:*:*:* Versions london patch_4 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:london:patch_4-1:*:*:*:*:*:* Versions london patch_4-1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:london:patch_4-2:*:*:*:*:*:* Versions london patch_4-2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:london:patch_4-3:*:*:*:*:*:* Versions london patch_4-3 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:london:patch_4-4:*:*:*:*:*:* Versions london patch_4-4 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:london:patch_4-5:*:*:*:*:*:* Versions london patch_4-5 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:london:patch_4-6:*:*:*:*:*:* Versions london patch_4-6 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:london:patch_5:*:*:*:*:*:* Versions london patch_5 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:london:patch_5-1:*:*:*:*:*:* Versions london patch_5-1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:london:patch_6:*:*:*:*:*:* Versions london patch_6 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:london:patch_6-1:*:*:*:*:*:* Versions london patch_6-1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:london:patch_6a-1:*:*:*:*:*:* Versions london patch_6a-1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:london:patch_6b-1:*:*:*:*:*:* Versions london patch_6b-1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:london:patch_7:*:*:*:*:*:* Versions london patch_7 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:madrid:-:*:*:*:*:*:* Versions madrid Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:madrid:patch_0-1:*:*:*:*:*:* Versions madrid patch_0-1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:madrid:patch_1:*:*:*:*:*:* Versions madrid patch_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:madrid:patch_1-1:*:*:*:*:*:* Versions madrid patch_1-1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:madrid:patch_1-2:*:*:*:*:*:* Versions madrid patch_1-2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:madrid:patch_2:*:*:*:*:*:* Versions madrid patch_2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:madrid:patch_3:*:*:*:*:*:* Versions madrid patch_3 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:madrid:patch_3-1:*:*:*:*:*:* Versions madrid patch_3-1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:it_service_management:madrid:patch_3-2:*:*:*:*:*:* Versions madrid patch_3-2 Vulnerable ·ServiceNow

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-20768
  2. 2026-10-03 Alias added: GHSA-pw7g-7762-p5qw

References

Exploit 1

Advisory 1

  • TI-2018-06294 ServiceNow ITSM 2016-06-02 has XSS via the First Name or Last Name field of My Profile… CVSS 3.0MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences