Read the docs
TI-2023-01143 Aliases CVE-2023-1209GHSA-gvxg-qc2x-rm9f

Cross-site scripting in ServiceNow Records

Priority LOW 25CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Cross-Site Scripting (XSS) vulnerabilities exist in ServiceNow records allowing an authenticated attacker to inject arbitrary scripts.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00376 31st percentileScored 2026-11-07
Fix Fixed ServiceNow Records (ServiceNow): Tokyo Patch 5, Tokyo Patch 4a, San Diego Patch 10 +3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ServiceNowServiceNow Recordsbefore Tokyo Patch 5; before Tokyo Patch 4a; before San Diego Patch 10; before San Diego Patch 9a; before Rome Patch 10 Hot Fix 4b; before Utah Patch 1Tokyo Patch 5, Tokyo Patch 4a, San Diego Patch 10, San Diego Patch 9a, Rome Patch 10 Hot Fix 4b, Utah Patch 1Patch availableCNA
  • ServiceNow Records VendorServiceNow Affected before Tokyo Patch 5; before Tokyo Patch 4a; before San Diego Patch 10; before San Diego Patch 9a; before Rome Patch 10 Hot Fix 4b; before Utah Patch 1 Fixed in Tokyo Patch 5, Tokyo Patch 4a, San Diego Patch 10, San Diego Patch 9a, Rome Patch 10 Hot Fix 4b, Utah Patch 1 Patch available CNA

CPE configurations NVD · 77

CPEVersionsRoleVendor
cpe:2.3:a:servicenow:servicenow:rome:-:*:*:*:*:*:*romeVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_1:*:*:*:*:*:*rome patch_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_1:*:*:*:*:*:*rome patch_1_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_1a:*:*:*:*:*:*rome patch_1_hotfix_1aVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_1b:*:*:*:*:*:*rome patch_1_hotfix_1bVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_2:*:*:*:*:*:*rome patch_1_hotfix_2VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_10:*:*:*:*:*:*rome patch_10VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_10_hotfix_1:*:*:*:*:*:*rome patch_10_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_10_hotfix_2:*:*:*:*:*:*rome patch_10_hotfix_2VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_10_hotfix_2a:*:*:*:*:*:*rome patch_10_hotfix_2aVulnerableServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:-:*:*:*:*:*:* Versions rome Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_1:*:*:*:*:*:* Versions rome patch_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_1:*:*:*:*:*:* Versions rome patch_1_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_1a:*:*:*:*:*:* Versions rome patch_1_hotfix_1a Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_1b:*:*:*:*:*:* Versions rome patch_1_hotfix_1b Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_1_hotfix_2:*:*:*:*:*:* Versions rome patch_1_hotfix_2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_10:*:*:*:*:*:* Versions rome patch_10 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_10_hotfix_1:*:*:*:*:*:* Versions rome patch_10_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_10_hotfix_2:*:*:*:*:*:* Versions rome patch_10_hotfix_2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_10_hotfix_2a:*:*:*:*:*:* Versions rome patch_10_hotfix_2a Vulnerable ·ServiceNow
Show 67 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:servicenow:servicenow:rome:patch_10_hotfix_2b:*:*:*:*:*:*rome patch_10_hotfix_2bVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_10_hotfix_3b:*:*:*:*:*:*rome patch_10_hotfix_3bVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_2:*:*:*:*:*:*rome patch_2VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_3:*:*:*:*:*:*rome patch_3VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_3_hotfix_1:*:*:*:*:*:*rome patch_3_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_4:*:*:*:*:*:*rome patch_4VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_4_hotfix_1:*:*:*:*:*:*rome patch_4_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_4_hotfix_1a:*:*:*:*:*:*rome patch_4_hotfix_1aVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_4_hotfix_1b:*:*:*:*:*:*rome patch_4_hotfix_1bVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_5:*:*:*:*:*:*rome patch_5VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_5_hotfix_1:*:*:*:*:*:*rome patch_5_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_5_hotfix_2:*:*:*:*:*:*rome patch_5_hotfix_2VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_6:*:*:*:*:*:*rome patch_6VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_6_hotfix_1:*:*:*:*:*:*rome patch_6_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_6_hotfix_2:*:*:*:*:*:*rome patch_6_hotfix_2VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_7_hotfix_1:*:*:*:*:*:*rome patch_7_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_7a:*:*:*:*:*:*rome patch_7aVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_7b:*:*:*:*:*:*rome patch_7bVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_8:*:*:*:*:*:*rome patch_8VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_8_hotfix_1:*:*:*:*:*:*rome patch_8_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_8_hotfix_2:*:*:*:*:*:*rome patch_8_hotfix_2VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_9:*:*:*:*:*:*rome patch_9VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_9_hotfix_1:*:*:*:*:*:*rome patch_9_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_9a:*:*:*:*:*:*rome patch_9aVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:rome:patch_9b:*:*:*:*:*:*rome patch_9bVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:-:*:*:*:*:*:*san_diegoVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_1:*:*:*:*:*:*san_diego patch_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1:*:*:*:*:*:*san_diego patch_1_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1a:*:*:*:*:*:*san_diego patch_1_hotfix_1aVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1b:*:*:*:*:*:*san_diego patch_1_hotfix_1bVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_2:*:*:*:*:*:*san_diego patch_2VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_2_hotfix_1:*:*:*:*:*:*san_diego patch_2_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_3:*:*:*:*:*:*san_diego patch_3VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_1:*:*:*:*:*:*san_diego patch_3_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_2:*:*:*:*:*:*san_diego patch_3_hotfix_2VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_3:*:*:*:*:*:*san_diego patch_3_hotfix_3VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_4:*:*:*:*:*:*san_diego patch_3_hotfix_4VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_4:*:*:*:*:*:*san_diego patch_4VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_4a:*:*:*:*:*:*san_diego patch_4aVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_6:*:*:*:*:*:*san_diego patch_6VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_7:*:*:*:*:*:*san_diego patch_7VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_7_hotfix_1:*:*:*:*:*:*san_diego patch_7_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_7_hotfix_2:*:*:*:*:*:*san_diego patch_7_hotfix_2VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_7_hottix_3:*:*:*:*:*:*san_diego patch_7_hottix_3VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_7a:*:*:*:*:*:*san_diego patch_7aVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_7b:*:*:*:*:*:*san_diego patch_7bVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_8:*:*:*:*:*:*san_diego patch_8VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_8_hotfix_1:*:*:*:*:*:*san_diego patch_8_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_8_hotfix_2:*:*:*:*:*:*san_diego patch_8_hotfix_2VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_9:*:*:*:*:*:*san_diego patch_9VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:-:*:*:*:*:*:*tokyoVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch_1:*:*:*:*:*:*tokyo patch_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch_1_hotfix_1:*:*:*:*:*:*tokyo patch_1_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch_1a:*:*:*:*:*:*tokyo patch_1aVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch_1b:*:*:*:*:*:*tokyo patch_1bVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch_2:*:*:*:*:*:*tokyo patch_2VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch_2_hotfix_1:*:*:*:*:*:*tokyo patch_2_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch_2_hotfix_2:*:*:*:*:*:*tokyo patch_2_hotfix_2VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch_2_hotfix_3:*:*:*:*:*:*tokyo patch_2_hotfix_3VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch_2_hotfix_4:*:*:*:*:*:*tokyo patch_2_hotfix_4VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch_3:*:*:*:*:*:*tokyo patch_3VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch_3_hotfix_1:*:*:*:*:*:*tokyo patch_3_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch_3_hotfix_2:*:*:*:*:*:*tokyo patch_3_hotfix_2VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch_3_hotfix_3:*:*:*:*:*:*tokyo patch_3_hotfix_3VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch_3_hotfix_4:*:*:*:*:*:*tokyo patch_3_hotfix_4VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch_4:*:*:*:*:*:*tokyo patch_4VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:utah:-:*:*:*:*:*:*utahVulnerableServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_10_hotfix_2b:*:*:*:*:*:* Versions rome patch_10_hotfix_2b Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_10_hotfix_3b:*:*:*:*:*:* Versions rome patch_10_hotfix_3b Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_2:*:*:*:*:*:* Versions rome patch_2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_3:*:*:*:*:*:* Versions rome patch_3 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_3_hotfix_1:*:*:*:*:*:* Versions rome patch_3_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_4:*:*:*:*:*:* Versions rome patch_4 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_4_hotfix_1:*:*:*:*:*:* Versions rome patch_4_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_4_hotfix_1a:*:*:*:*:*:* Versions rome patch_4_hotfix_1a Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_4_hotfix_1b:*:*:*:*:*:* Versions rome patch_4_hotfix_1b Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_5:*:*:*:*:*:* Versions rome patch_5 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_5_hotfix_1:*:*:*:*:*:* Versions rome patch_5_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_5_hotfix_2:*:*:*:*:*:* Versions rome patch_5_hotfix_2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_6:*:*:*:*:*:* Versions rome patch_6 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_6_hotfix_1:*:*:*:*:*:* Versions rome patch_6_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_6_hotfix_2:*:*:*:*:*:* Versions rome patch_6_hotfix_2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_7_hotfix_1:*:*:*:*:*:* Versions rome patch_7_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_7a:*:*:*:*:*:* Versions rome patch_7a Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_7b:*:*:*:*:*:* Versions rome patch_7b Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_8:*:*:*:*:*:* Versions rome patch_8 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_8_hotfix_1:*:*:*:*:*:* Versions rome patch_8_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_8_hotfix_2:*:*:*:*:*:* Versions rome patch_8_hotfix_2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_9:*:*:*:*:*:* Versions rome patch_9 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_9_hotfix_1:*:*:*:*:*:* Versions rome patch_9_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_9a:*:*:*:*:*:* Versions rome patch_9a Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:rome:patch_9b:*:*:*:*:*:* Versions rome patch_9b Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:-:*:*:*:*:*:* Versions san_diego Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_1:*:*:*:*:*:* Versions san_diego patch_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1:*:*:*:*:*:* Versions san_diego patch_1_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1a:*:*:*:*:*:* Versions san_diego patch_1_hotfix_1a Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1b:*:*:*:*:*:* Versions san_diego patch_1_hotfix_1b Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_2:*:*:*:*:*:* Versions san_diego patch_2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_2_hotfix_1:*:*:*:*:*:* Versions san_diego patch_2_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_3:*:*:*:*:*:* Versions san_diego patch_3 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_1:*:*:*:*:*:* Versions san_diego patch_3_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_2:*:*:*:*:*:* Versions san_diego patch_3_hotfix_2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_3:*:*:*:*:*:* Versions san_diego patch_3_hotfix_3 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_4:*:*:*:*:*:* Versions san_diego patch_3_hotfix_4 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_4:*:*:*:*:*:* Versions san_diego patch_4 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_4a:*:*:*:*:*:* Versions san_diego patch_4a Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_6:*:*:*:*:*:* Versions san_diego patch_6 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_7:*:*:*:*:*:* Versions san_diego patch_7 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_7_hotfix_1:*:*:*:*:*:* Versions san_diego patch_7_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_7_hotfix_2:*:*:*:*:*:* Versions san_diego patch_7_hotfix_2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_7_hottix_3:*:*:*:*:*:* Versions san_diego patch_7_hottix_3 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_7a:*:*:*:*:*:* Versions san_diego patch_7a Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_7b:*:*:*:*:*:* Versions san_diego patch_7b Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_8:*:*:*:*:*:* Versions san_diego patch_8 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_8_hotfix_1:*:*:*:*:*:* Versions san_diego patch_8_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_8_hotfix_2:*:*:*:*:*:* Versions san_diego patch_8_hotfix_2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_9:*:*:*:*:*:* Versions san_diego patch_9 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:-:*:*:*:*:*:* Versions tokyo Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch_1:*:*:*:*:*:* Versions tokyo patch_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch_1_hotfix_1:*:*:*:*:*:* Versions tokyo patch_1_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch_1a:*:*:*:*:*:* Versions tokyo patch_1a Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch_1b:*:*:*:*:*:* Versions tokyo patch_1b Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch_2:*:*:*:*:*:* Versions tokyo patch_2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch_2_hotfix_1:*:*:*:*:*:* Versions tokyo patch_2_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch_2_hotfix_2:*:*:*:*:*:* Versions tokyo patch_2_hotfix_2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch_2_hotfix_3:*:*:*:*:*:* Versions tokyo patch_2_hotfix_3 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch_2_hotfix_4:*:*:*:*:*:* Versions tokyo patch_2_hotfix_4 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch_3:*:*:*:*:*:* Versions tokyo patch_3 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch_3_hotfix_1:*:*:*:*:*:* Versions tokyo patch_3_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch_3_hotfix_2:*:*:*:*:*:* Versions tokyo patch_3_hotfix_2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch_3_hotfix_3:*:*:*:*:*:* Versions tokyo patch_3_hotfix_3 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch_3_hotfix_4:*:*:*:*:*:* Versions tokyo patch_3_hotfix_4 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch_4:*:*:*:*:*:* Versions tokyo patch_4 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:utah:-:*:*:*:*:*:* Versions utah Vulnerable ·ServiceNow

Remediation

  • Fix · CNA ServiceNow Records (ServiceNow) Fixed in Tokyo Patch 5, Tokyo Patch 4a, San Diego Patch 10, San Diego Patch 9a, Rome Patch 10 Hot Fix 4b, Utah Patch 1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-1209
  2. 2026-10-03 Alias added: GHSA-gvxg-qc2x-rm9f

References

Advisory 1

Other 1

  • TI-2024-04841 Incomplete Input Validation in GlideExpression Script KEVCVSS 4.0CRITICAL 9.2
  • TI-2024-04536 Jelly Template Injection Vulnerability in ServiceNow UI Macros KEVCVSS 4.0CRITICAL 9.3
  • TI-2024-08286 Sandbox Escape in Now Platform CVSS 4.0CRITICAL 9.3
  • TI-2022-21442 ACL bypass in Reporting functionality CVSS 3.1CRITICAL 9.9
  • TI-2024-08287 Unauthenticated Blind SQL Injection in Core Platform CVSS 4.0HIGH 8.7
  • TI-2018-05591 report_viewer.do in ServiceNow Release Jakarta Patch 8 and earlier allows remote… CVSS 3.0HIGH 8.8
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences