Read the docs
TI-2022-22922 Aliases CVE-2022-46389GHSA-9q54-3p63-8rwp

Cross-Site Scripting (XSS) vulnerability found on logout functionality

Priority LOW 28CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

There exists a reflected XSS within the logout functionality of ServiceNow versions lower than Quebec Patch 10 Hotfix 11b, Rome Patch 10 Hotfix 3b, San Diego Patch 9, Tokyo Patch 4, and Utah GA. This enables an unauthenticated remote attacker to execute arbitrary JavaScript code in the browser-based web console.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00595 48th percentileScored 2026-11-07
Fix Fixed Now Platform (ServiceNow): Patch 10 Hotfix 11b, Patch 10 Hotfix 3b, Patch 9 +2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ServiceNowNow PlatformQuebec to before Patch 10 Hotfix 11b; Rome to before Patch 10 Hotfix 3b; San Diego to before Patch 9; Tokyo to before Patch 4; Utah to before GAPatch 10 Hotfix 11b, Patch 10 Hotfix 3b, Patch 9, Patch 4, GAPatch availableCNA
  • Now Platform VendorServiceNow Affected Quebec to before Patch 10 Hotfix 11b; Rome to before Patch 10 Hotfix 3b; San Diego to before Patch 9; Tokyo to before Patch 4; Utah to before GA Fixed in Patch 10 Hotfix 11b, Patch 10 Hotfix 3b, Patch 9, Patch 4, GA Patch available CNA

CPE configurations NVD · 47

CPEVersionsRoleVendor
cpe:2.3:a:servicenow:servicenow:quebec:-:*:*:*:*:*:*quebecVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:-:*:*:*:*:*:*romeVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:early_availability:*:*:*:*:*:*rome early_availabilityVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_1:*:*:*:*:*:*rome patch_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_1a:*:*:*:*:*:*rome patch_1_hotfix_1aVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_1b:*:*:*:*:*:*rome patch_1_hotfix_1bVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_10:*:*:*:*:*:*rome patch_10VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_2:*:*:*:*:*:*rome patch_2VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_3:*:*:*:*:*:*rome patch_3VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_4:*:*:*:*:*:*rome patch_4VulnerableServiceNow
  • cpe:2.3:a:servicenow:servicenow:quebec:-:*:*:*:*:*:* Versions quebec Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:-:*:*:*:*:*:* Versions rome Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:early_availability:*:*:*:*:*:* Versions rome early_availability Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_1:*:*:*:*:*:* Versions rome patch_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_1a:*:*:*:*:*:* Versions rome patch_1_hotfix_1a Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_1b:*:*:*:*:*:* Versions rome patch_1_hotfix_1b Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_10:*:*:*:*:*:* Versions rome patch_10 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_2:*:*:*:*:*:* Versions rome patch_2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_3:*:*:*:*:*:* Versions rome patch_3 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_4:*:*:*:*:*:* Versions rome patch_4 Vulnerable ·ServiceNow
Show 37 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:servicenow:servicenow:rome:patch_4_hotfix_1:*:*:*:*:*:*rome patch_4_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_4_hotfix_1a:*:*:*:*:*:*rome patch_4_hotfix_1aVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_4_hotfix_1b:*:*:*:*:*:*rome patch_4_hotfix_1bVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_5:*:*:*:*:*:*rome patch_5VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_6:*:*:*:*:*:*rome patch_6VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_7:*:*:*:*:*:*rome patch_7VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_7a:*:*:*:*:*:*rome patch_7aVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_7b:*:*:*:*:*:*rome patch_7bVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_8:*:*:*:*:*:*rome patch_8VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_9:*:*:*:*:*:*rome patch_9VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_9a:*:*:*:*:*:*rome patch_9aVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:-:*:*:*:*:*:*san_diegoVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_1:*:*:*:*:*:*san_diego patch_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1:*:*:*:*:*:*san_diego patch_1_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1a:*:*:*:*:*:*san_diego patch_1_hotfix_1aVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1b:*:*:*:*:*:*san_diego patch_1_hotfix_1bVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_2:*:*:*:*:*:*san_diego patch_2VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_3:*:*:*:*:*:*san_diego patch_3VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_4:*:*:*:*:*:*san_diego patch_4VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_4a:*:*:*:*:*:*san_diego patch_4aVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_4b:*:*:*:*:*:*san_diego patch_4bVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_5:*:*:*:*:*:*san_diego patch_5VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_6:*:*:*:*:*:*san_diego patch_6VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_7:*:*:*:*:*:*san_diego patch_7VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_7b:*:*:*:*:*:*san_diego patch_7bVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_8:*:*:*:*:*:*san_diego patch_8VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:-:*:*:*:*:*:*tokyoVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:early_availability:*:*:*:*:*:*tokyo early_availabilityVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch_1:*:*:*:*:*:*tokyo patch_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch_1a:*:*:*:*:*:*tokyo patch_1aVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch_1b:*:*:*:*:*:*tokyo patch_1bVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch_2:*:*:*:*:*:*tokyo patch_2VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch_3:*:*:*:*:*:*tokyo patch_3VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:utah:-:*:*:*:*:*:*utahVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:utah:early_availability:*:*:*:*:*:*utah early_availabilityVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:utah:patch_1:*:*:*:*:*:*utah patch_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:utah:patch_2:*:*:*:*:*:*utah patch_2VulnerableServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_4_hotfix_1:*:*:*:*:*:* Versions rome patch_4_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_4_hotfix_1a:*:*:*:*:*:* Versions rome patch_4_hotfix_1a Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_4_hotfix_1b:*:*:*:*:*:* Versions rome patch_4_hotfix_1b Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_5:*:*:*:*:*:* Versions rome patch_5 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_6:*:*:*:*:*:* Versions rome patch_6 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_7:*:*:*:*:*:* Versions rome patch_7 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_7a:*:*:*:*:*:* Versions rome patch_7a Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_7b:*:*:*:*:*:* Versions rome patch_7b Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_8:*:*:*:*:*:* Versions rome patch_8 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_9:*:*:*:*:*:* Versions rome patch_9 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_9a:*:*:*:*:*:* Versions rome patch_9a Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:-:*:*:*:*:*:* Versions san_diego Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_1:*:*:*:*:*:* Versions san_diego patch_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1:*:*:*:*:*:* Versions san_diego patch_1_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1a:*:*:*:*:*:* Versions san_diego patch_1_hotfix_1a Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1b:*:*:*:*:*:* Versions san_diego patch_1_hotfix_1b Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_2:*:*:*:*:*:* Versions san_diego patch_2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_3:*:*:*:*:*:* Versions san_diego patch_3 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_4:*:*:*:*:*:* Versions san_diego patch_4 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_4a:*:*:*:*:*:* Versions san_diego patch_4a Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_4b:*:*:*:*:*:* Versions san_diego patch_4b Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_5:*:*:*:*:*:* Versions san_diego patch_5 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_6:*:*:*:*:*:* Versions san_diego patch_6 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_7:*:*:*:*:*:* Versions san_diego patch_7 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_7b:*:*:*:*:*:* Versions san_diego patch_7b Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_8:*:*:*:*:*:* Versions san_diego patch_8 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:-:*:*:*:*:*:* Versions tokyo Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:early_availability:*:*:*:*:*:* Versions tokyo early_availability Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch_1:*:*:*:*:*:* Versions tokyo patch_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch_1a:*:*:*:*:*:* Versions tokyo patch_1a Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch_1b:*:*:*:*:*:* Versions tokyo patch_1b Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch_2:*:*:*:*:*:* Versions tokyo patch_2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch_3:*:*:*:*:*:* Versions tokyo patch_3 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:utah:-:*:*:*:*:*:* Versions utah Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:utah:early_availability:*:*:*:*:*:* Versions utah early_availability Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:utah:patch_1:*:*:*:*:*:* Versions utah patch_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:utah:patch_2:*:*:*:*:*:* Versions utah patch_2 Vulnerable ·ServiceNow

Remediation

  • Fix · CNA Now Platform (ServiceNow) Fixed in Patch 10 Hotfix 11b, Patch 10 Hotfix 3b, Patch 9, Patch 4, GA

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-46389
  2. 2026-10-03 Alias added: GHSA-9q54-3p63-8rwp

References

Advisory 1

  • TI-2024-04841 Incomplete Input Validation in GlideExpression Script KEVCVSS 4.0CRITICAL 9.2
  • TI-2024-04536 Jelly Template Injection Vulnerability in ServiceNow UI Macros KEVCVSS 4.0CRITICAL 9.3
  • TI-2024-08286 Sandbox Escape in Now Platform CVSS 4.0CRITICAL 9.3
  • TI-2022-21442 ACL bypass in Reporting functionality CVSS 3.1CRITICAL 9.9
  • TI-2024-08287 Unauthenticated Blind SQL Injection in Core Platform CVSS 4.0HIGH 8.7
  • TI-2018-05591 report_viewer.do in ServiceNow Release Jakarta Patch 8 and earlier allows remote… CVSS 3.0HIGH 8.8
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences