Read the docs
TI-2022-23229 Aliases CVE-2022-46886GHSA-fwxm-w6rg-c4gp

Open redirect in ServiceNow

Priority LOW 27CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-601.

Summary

There exists an open redirect within the response list update functionality of ServiceNow. This allows attackers to redirect users to arbitrary domains when clicking on a URL within a service-now domain.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00299 22nd percentileScored 2026-11-07
Fix Fixed ServiceNow (ServiceNow): Tokyo Patch 1b, San Diego Patch 7b, Rome Patch 10 Hotfix 2b +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ServiceNowServiceNowTokyo to before Tokyo Patch 1b; San Diego to before San Diego Patch 7b; Rome to before Rome Patch 10 Hotfix 2b; Quebec to before Quebec Patch 10 Hotfix 10bTokyo Patch 1b, San Diego Patch 7b, Rome Patch 10 Hotfix 2b, Quebec Patch 10 Hotfix 10bPatch availableCNA
  • ServiceNow VendorServiceNow Affected Tokyo to before Tokyo Patch 1b; San Diego to before San Diego Patch 7b; Rome to before Rome Patch 10 Hotfix 2b; Quebec to before Quebec Patch 10 Hotfix 10b Fixed in Tokyo Patch 1b, San Diego Patch 7b, Rome Patch 10 Hotfix 2b, Quebec Patch 10 Hotfix 10b Patch available CNA

CPE configurations NVD · 56

CPEVersionsRoleVendor
cpe:2.3:a:servicenow:servicenow:quebec:-:*:*:*:*:*:*quebecVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:quebec:patch_10:*:*:*:*:*:*quebec patch_10VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_1:*:*:*:*:*:*rome patch_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_1:*:*:*:*:*:*rome patch_1_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_1b:*:*:*:*:*:*rome patch_1_hotfix_1bVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_2:*:*:*:*:*:*rome patch_1_hotfix_2VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_3:*:*:*:*:*:*rome patch_1_hotfix_3VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_10:*:*:*:*:*:*rome patch_10VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_10_hotfix_1:*:*:*:*:*:*rome patch_10_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_10_hotfix_2:*:*:*:*:*:*rome patch_10_hotfix_2VulnerableServiceNow
  • cpe:2.3:a:servicenow:servicenow:quebec:-:*:*:*:*:*:* Versions quebec Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:quebec:patch_10:*:*:*:*:*:* Versions quebec patch_10 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_1:*:*:*:*:*:* Versions rome patch_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_1:*:*:*:*:*:* Versions rome patch_1_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_1b:*:*:*:*:*:* Versions rome patch_1_hotfix_1b Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_2:*:*:*:*:*:* Versions rome patch_1_hotfix_2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_3:*:*:*:*:*:* Versions rome patch_1_hotfix_3 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_10:*:*:*:*:*:* Versions rome patch_10 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_10_hotfix_1:*:*:*:*:*:* Versions rome patch_10_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_10_hotfix_2:*:*:*:*:*:* Versions rome patch_10_hotfix_2 Vulnerable ·ServiceNow
Show 46 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:servicenow:servicenow:rome:patch_10_hotfix_2a:*:*:*:*:*:*rome patch_10_hotfix_2aVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_2:*:*:*:*:*:*rome patch_2VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_2_hotfix_1:*:*:*:*:*:*rome patch_2_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_2_hotfix_2:*:*:*:*:*:*rome patch_2_hotfix_2VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_3:*:*:*:*:*:*rome patch_3VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_3_hotfix_1:*:*:*:*:*:*rome patch_3_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_4:*:*:*:*:*:*rome patch_4VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_4_hotfix_1:*:*:*:*:*:*rome patch_4_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_4_hotfix_1a:*:*:*:*:*:*rome patch_4_hotfix_1aVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_4_hotfix_1b:*:*:*:*:*:*rome patch_4_hotfix_1bVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_5:*:*:*:*:*:*rome patch_5VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_5_hotfix_1:*:*:*:*:*:*rome patch_5_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_5_hotfix_2:*:*:*:*:*:*rome patch_5_hotfix_2VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_6:*:*:*:*:*:*rome patch_6VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_6_hotfix_1:*:*:*:*:*:*rome patch_6_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_6_hotfix_2:*:*:*:*:*:*rome patch_6_hotfix_2VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_7:*:*:*:*:*:*rome patch_7VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_7_hotfix_1:*:*:*:*:*:*rome patch_7_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_7a:*:*:*:*:*:*rome patch_7aVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_7b:*:*:*:*:*:*rome patch_7bVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_8:*:*:*:*:*:*rome patch_8VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_8_hotfix_1:*:*:*:*:*:*rome patch_8_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_8_hotfix_2:*:*:*:*:*:*rome patch_8_hotfix_2VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_9:*:*:*:*:*:*rome patch_9VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_9_hotfix_1:*:*:*:*:*:*rome patch_9_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_9a:*:*:*:*:*:*rome patch_9aVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_9b:*:*:*:*:*:*rome patch_9bVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_1:*:*:*:*:*:*san_diego patch_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1:*:*:*:*:*:*san_diego patch_1_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1a:*:*:*:*:*:*san_diego patch_1_hotfix_1aVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1b:*:*:*:*:*:*san_diego patch_1_hotfix_1bVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_2:*:*:*:*:*:*san_diego patch_2VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_2_hotfix_1:*:*:*:*:*:*san_diego patch_2_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_3:*:*:*:*:*:*san_diego patch_3VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_1:*:*:*:*:*:*san_diego patch_3_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_2:*:*:*:*:*:*san_diego patch_3_hotfix_2VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_3:*:*:*:*:*:*san_diego patch_3_hotfix_3VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_4:*:*:*:*:*:*san_diego patch_3_hotfix_4VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_4:*:*:*:*:*:*san_diego patch_4VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_4a:*:*:*:*:*:*san_diego patch_4aVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_4b:*:*:*:*:*:*san_diego patch_4bVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_6:*:*:*:*:*:*san_diego patch_6VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_7:*:*:*:*:*:*san_diego patch_7VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_8:*:*:*:*:*:*san_diego patch_8VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:-:*:*:*:*:*:*tokyoVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch1:*:*:*:*:*:*tokyo patch1VulnerableServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_10_hotfix_2a:*:*:*:*:*:* Versions rome patch_10_hotfix_2a Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_2:*:*:*:*:*:* Versions rome patch_2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_2_hotfix_1:*:*:*:*:*:* Versions rome patch_2_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_2_hotfix_2:*:*:*:*:*:* Versions rome patch_2_hotfix_2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_3:*:*:*:*:*:* Versions rome patch_3 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_3_hotfix_1:*:*:*:*:*:* Versions rome patch_3_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_4:*:*:*:*:*:* Versions rome patch_4 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_4_hotfix_1:*:*:*:*:*:* Versions rome patch_4_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_4_hotfix_1a:*:*:*:*:*:* Versions rome patch_4_hotfix_1a Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_4_hotfix_1b:*:*:*:*:*:* Versions rome patch_4_hotfix_1b Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_5:*:*:*:*:*:* Versions rome patch_5 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_5_hotfix_1:*:*:*:*:*:* Versions rome patch_5_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_5_hotfix_2:*:*:*:*:*:* Versions rome patch_5_hotfix_2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_6:*:*:*:*:*:* Versions rome patch_6 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_6_hotfix_1:*:*:*:*:*:* Versions rome patch_6_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_6_hotfix_2:*:*:*:*:*:* Versions rome patch_6_hotfix_2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_7:*:*:*:*:*:* Versions rome patch_7 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_7_hotfix_1:*:*:*:*:*:* Versions rome patch_7_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_7a:*:*:*:*:*:* Versions rome patch_7a Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_7b:*:*:*:*:*:* Versions rome patch_7b Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_8:*:*:*:*:*:* Versions rome patch_8 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_8_hotfix_1:*:*:*:*:*:* Versions rome patch_8_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_8_hotfix_2:*:*:*:*:*:* Versions rome patch_8_hotfix_2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_9:*:*:*:*:*:* Versions rome patch_9 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_9_hotfix_1:*:*:*:*:*:* Versions rome patch_9_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_9a:*:*:*:*:*:* Versions rome patch_9a Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_9b:*:*:*:*:*:* Versions rome patch_9b Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_1:*:*:*:*:*:* Versions san_diego patch_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1:*:*:*:*:*:* Versions san_diego patch_1_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1a:*:*:*:*:*:* Versions san_diego patch_1_hotfix_1a Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1b:*:*:*:*:*:* Versions san_diego patch_1_hotfix_1b Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_2:*:*:*:*:*:* Versions san_diego patch_2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_2_hotfix_1:*:*:*:*:*:* Versions san_diego patch_2_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_3:*:*:*:*:*:* Versions san_diego patch_3 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_1:*:*:*:*:*:* Versions san_diego patch_3_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_2:*:*:*:*:*:* Versions san_diego patch_3_hotfix_2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_3:*:*:*:*:*:* Versions san_diego patch_3_hotfix_3 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_4:*:*:*:*:*:* Versions san_diego patch_3_hotfix_4 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_4:*:*:*:*:*:* Versions san_diego patch_4 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_4a:*:*:*:*:*:* Versions san_diego patch_4a Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_4b:*:*:*:*:*:* Versions san_diego patch_4b Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_6:*:*:*:*:*:* Versions san_diego patch_6 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_7:*:*:*:*:*:* Versions san_diego patch_7 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_8:*:*:*:*:*:* Versions san_diego patch_8 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:-:*:*:*:*:*:* Versions tokyo Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch1:*:*:*:*:*:* Versions tokyo patch1 Vulnerable ·ServiceNow

Remediation

  • Fix · CNA ServiceNow (ServiceNow) Fixed in Tokyo Patch 1b, San Diego Patch 7b, Rome Patch 10 Hotfix 2b, Quebec Patch 10 Hotfix 10b

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-46886
  2. 2026-10-03 Alias added: GHSA-fwxm-w6rg-c4gp

References

Advisory 1

  • TI-2024-04841 Incomplete Input Validation in GlideExpression Script KEVCVSS 4.0CRITICAL 9.2
  • TI-2024-04536 Jelly Template Injection Vulnerability in ServiceNow UI Macros KEVCVSS 4.0CRITICAL 9.3
  • TI-2024-08286 Sandbox Escape in Now Platform CVSS 4.0CRITICAL 9.3
  • TI-2022-21442 ACL bypass in Reporting functionality CVSS 3.1CRITICAL 9.9
  • TI-2024-08287 Unauthenticated Blind SQL Injection in Core Platform CVSS 4.0HIGH 8.7
  • TI-2018-05591 report_viewer.do in ServiceNow Release Jakarta Patch 8 and earlier allows remote… CVSS 3.0HIGH 8.8
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences