Read the docs
TI-2022-18440 Aliases CVE-2022-39048GHSA-48vw-436h-p87m

Cross-Site Scripting (XSS) vulnerability in ServiceNow UI page assessment_redirect

Priority LOW 29CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

A XSS vulnerability was identified in the ServiceNow UI page assessment_redirect. To exploit this vulnerability, an attacker would need to persuade an authenticated user to click a maliciously crafted URL. Successful exploitation potentially could be used to conduct various client-side attacks, including, but not limited to, phishing, redirection, theft of CSRF tokens, and use of an authenticated user's browser or session to attack other systems.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01089 65th percentileScored 2026-11-07
Fix Fixed Now Platform (Servicenow): Patch 1a, Patch 7b, Patch 10 Hotfix 2b +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ServiceNowNow PlatformTokyo to before Patch 1a; San Diego to before Patch 7b; Rome to before Patch 10 Hotfix 2b; Quebec to before Patch 10 Hotfix 10bPatch 1a, Patch 7b, Patch 10 Hotfix 2b, Patch 10 Hotfix 10bPatch availableCNA
  • Now Platform VendorServiceNow Affected Tokyo to before Patch 1a; San Diego to before Patch 7b; Rome to before Patch 10 Hotfix 2b; Quebec to before Patch 10 Hotfix 10b Fixed in Patch 1a, Patch 7b, Patch 10 Hotfix 2b, Patch 10 Hotfix 10b Patch available CNA

CPE configurations NVD · 57

CPEVersionsRoleVendor
cpe:2.3:a:servicenow:servicenow:quebec:-:*:*:*:*:*:*quebecVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:quebec:patch_10:*:*:*:*:*:*quebec patch_10VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_1:*:*:*:*:*:*rome patch_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_1:*:*:*:*:*:*rome patch_1_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_1b:*:*:*:*:*:*rome patch_1_hotfix_1bVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_2:*:*:*:*:*:*rome patch_1_hotfix_2VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_3:*:*:*:*:*:*rome patch_1_hotfix_3VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_10:*:*:*:*:*:*rome patch_10VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_10_hotfix_1:*:*:*:*:*:*rome patch_10_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_10_hotfix_2:*:*:*:*:*:*rome patch_10_hotfix_2VulnerableServiceNow
  • cpe:2.3:a:servicenow:servicenow:quebec:-:*:*:*:*:*:* Versions quebec Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:quebec:patch_10:*:*:*:*:*:* Versions quebec patch_10 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_1:*:*:*:*:*:* Versions rome patch_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_1:*:*:*:*:*:* Versions rome patch_1_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_1b:*:*:*:*:*:* Versions rome patch_1_hotfix_1b Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_2:*:*:*:*:*:* Versions rome patch_1_hotfix_2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_3:*:*:*:*:*:* Versions rome patch_1_hotfix_3 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_10:*:*:*:*:*:* Versions rome patch_10 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_10_hotfix_1:*:*:*:*:*:* Versions rome patch_10_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_10_hotfix_2:*:*:*:*:*:* Versions rome patch_10_hotfix_2 Vulnerable ·ServiceNow
Show 47 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:servicenow:servicenow:rome:patch_10_hotfix_2a:*:*:*:*:*:*rome patch_10_hotfix_2aVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_2:*:*:*:*:*:*rome patch_2VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_2_hotfix_1:*:*:*:*:*:*rome patch_2_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_2_hotfix_2:*:*:*:*:*:*rome patch_2_hotfix_2VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_3:*:*:*:*:*:*rome patch_3VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_3_hotfix_1:*:*:*:*:*:*rome patch_3_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_4:*:*:*:*:*:*rome patch_4VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_4_hotfix_1:*:*:*:*:*:*rome patch_4_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_4_hotfix_1a:*:*:*:*:*:*rome patch_4_hotfix_1aVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_4_hotfix_1b:*:*:*:*:*:*rome patch_4_hotfix_1bVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_5:*:*:*:*:*:*rome patch_5VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_5_hotfix_1:*:*:*:*:*:*rome patch_5_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_5_hotfix_2:*:*:*:*:*:*rome patch_5_hotfix_2VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_6:*:*:*:*:*:*rome patch_6VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_6_hotfix_1:*:*:*:*:*:*rome patch_6_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_6_hotfix_2:*:*:*:*:*:*rome patch_6_hotfix_2VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_7:*:*:*:*:*:*rome patch_7VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_7_hotfix_1:*:*:*:*:*:*rome patch_7_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_7a:*:*:*:*:*:*rome patch_7aVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_7b:*:*:*:*:*:*rome patch_7bVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_8:*:*:*:*:*:*rome patch_8VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_8_hotfix_1:*:*:*:*:*:*rome patch_8_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_8_hotfix_2:*:*:*:*:*:*rome patch_8_hotfix_2VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_9:*:*:*:*:*:*rome patch_9VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_9_hotfix_1:*:*:*:*:*:*rome patch_9_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_9a:*:*:*:*:*:*rome patch_9aVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_9b:*:*:*:*:*:*rome patch_9bVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_1:*:*:*:*:*:*san_diego patch_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1:*:*:*:*:*:*san_diego patch_1_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1a:*:*:*:*:*:*san_diego patch_1_hotfix_1aVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1b:*:*:*:*:*:*san_diego patch_1_hotfix_1bVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_2:*:*:*:*:*:*san_diego patch_2VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_2_hotfix_1:*:*:*:*:*:*san_diego patch_2_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_3:*:*:*:*:*:*san_diego patch_3VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_1:*:*:*:*:*:*san_diego patch_3_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_2:*:*:*:*:*:*san_diego patch_3_hotfix_2VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_3:*:*:*:*:*:*san_diego patch_3_hotfix_3VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_4:*:*:*:*:*:*san_diego patch_3_hotfix_4VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_4:*:*:*:*:*:*san_diego patch_4VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_4a:*:*:*:*:*:*san_diego patch_4aVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_4b:*:*:*:*:*:*san_diego patch_4bVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_6:*:*:*:*:*:*san_diego patch_6VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_7:*:*:*:*:*:*san_diego patch_7VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_8:*:*:*:*:*:*san_diego patch_8VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:-:*:*:*:*:*:*tokyoVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch1:*:*:*:*:*:*tokyo patch1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:utah:-:*:*:*:*:*:*utahVulnerableServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_10_hotfix_2a:*:*:*:*:*:* Versions rome patch_10_hotfix_2a Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_2:*:*:*:*:*:* Versions rome patch_2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_2_hotfix_1:*:*:*:*:*:* Versions rome patch_2_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_2_hotfix_2:*:*:*:*:*:* Versions rome patch_2_hotfix_2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_3:*:*:*:*:*:* Versions rome patch_3 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_3_hotfix_1:*:*:*:*:*:* Versions rome patch_3_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_4:*:*:*:*:*:* Versions rome patch_4 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_4_hotfix_1:*:*:*:*:*:* Versions rome patch_4_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_4_hotfix_1a:*:*:*:*:*:* Versions rome patch_4_hotfix_1a Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_4_hotfix_1b:*:*:*:*:*:* Versions rome patch_4_hotfix_1b Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_5:*:*:*:*:*:* Versions rome patch_5 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_5_hotfix_1:*:*:*:*:*:* Versions rome patch_5_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_5_hotfix_2:*:*:*:*:*:* Versions rome patch_5_hotfix_2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_6:*:*:*:*:*:* Versions rome patch_6 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_6_hotfix_1:*:*:*:*:*:* Versions rome patch_6_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_6_hotfix_2:*:*:*:*:*:* Versions rome patch_6_hotfix_2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_7:*:*:*:*:*:* Versions rome patch_7 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_7_hotfix_1:*:*:*:*:*:* Versions rome patch_7_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_7a:*:*:*:*:*:* Versions rome patch_7a Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_7b:*:*:*:*:*:* Versions rome patch_7b Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_8:*:*:*:*:*:* Versions rome patch_8 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_8_hotfix_1:*:*:*:*:*:* Versions rome patch_8_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_8_hotfix_2:*:*:*:*:*:* Versions rome patch_8_hotfix_2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_9:*:*:*:*:*:* Versions rome patch_9 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_9_hotfix_1:*:*:*:*:*:* Versions rome patch_9_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_9a:*:*:*:*:*:* Versions rome patch_9a Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_9b:*:*:*:*:*:* Versions rome patch_9b Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_1:*:*:*:*:*:* Versions san_diego patch_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1:*:*:*:*:*:* Versions san_diego patch_1_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1a:*:*:*:*:*:* Versions san_diego patch_1_hotfix_1a Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1b:*:*:*:*:*:* Versions san_diego patch_1_hotfix_1b Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_2:*:*:*:*:*:* Versions san_diego patch_2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_2_hotfix_1:*:*:*:*:*:* Versions san_diego patch_2_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_3:*:*:*:*:*:* Versions san_diego patch_3 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_1:*:*:*:*:*:* Versions san_diego patch_3_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_2:*:*:*:*:*:* Versions san_diego patch_3_hotfix_2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_3:*:*:*:*:*:* Versions san_diego patch_3_hotfix_3 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_4:*:*:*:*:*:* Versions san_diego patch_3_hotfix_4 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_4:*:*:*:*:*:* Versions san_diego patch_4 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_4a:*:*:*:*:*:* Versions san_diego patch_4a Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_4b:*:*:*:*:*:* Versions san_diego patch_4b Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_6:*:*:*:*:*:* Versions san_diego patch_6 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_7:*:*:*:*:*:* Versions san_diego patch_7 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_8:*:*:*:*:*:* Versions san_diego patch_8 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:-:*:*:*:*:*:* Versions tokyo Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch1:*:*:*:*:*:* Versions tokyo patch1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:utah:-:*:*:*:*:*:* Versions utah Vulnerable ·ServiceNow

Remediation

  • Fix · CNA Now Platform (Servicenow) Fixed in Patch 1a, Patch 7b, Patch 10 Hotfix 2b, Patch 10 Hotfix 10b

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-39048
  2. 2026-10-03 Alias added: GHSA-48vw-436h-p87m

References

Other 2

  • TI-2024-04841 Incomplete Input Validation in GlideExpression Script KEVCVSS 4.0CRITICAL 9.2
  • TI-2024-04536 Jelly Template Injection Vulnerability in ServiceNow UI Macros KEVCVSS 4.0CRITICAL 9.3
  • TI-2024-08286 Sandbox Escape in Now Platform CVSS 4.0CRITICAL 9.3
  • TI-2022-21442 ACL bypass in Reporting functionality CVSS 3.1CRITICAL 9.9
  • TI-2024-08287 Unauthenticated Blind SQL Injection in Core Platform CVSS 4.0HIGH 8.7
  • TI-2018-05591 report_viewer.do in ServiceNow Release Jakarta Patch 8 and earlier allows remote… CVSS 3.0HIGH 8.8
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences