Read the docs
TI-2023-01225 Aliases CVE-2023-1298GHSA-vrrx-r38v-p3m7

Cross-site scripting in ServiceNow Now User Experience

Priority LOW 27CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

ServiceNow has released upgrades and patches that address a Reflected Cross-Site scripting (XSS) vulnerability that was identified in the ServiceNow Polaris Layout. This vulnerability would enable an authenticated user to inject arbitrary scripts.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00394 33rd percentileScored 2026-11-07
Fix Fixed Now User Experience (ServiceNow): San Diego Patch 10, Tokyo Patch 4b, Tokyo Patch 6 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ServiceNowNow User Experiencebefore San Diego Patch 10; before Tokyo Patch 4b; before Tokyo Patch 6; before Utah Patch 1San Diego Patch 10, Tokyo Patch 4b, Tokyo Patch 6, Utah Patch 1Patch availableCNA
  • Now User Experience VendorServiceNow Affected before San Diego Patch 10; before Tokyo Patch 4b; before Tokyo Patch 6; before Utah Patch 1 Fixed in San Diego Patch 10, Tokyo Patch 4b, Tokyo Patch 6, Utah Patch 1 Patch available CNA

CPE configurations NVD · 54

CPEVersionsRoleVendor
cpe:2.3:a:servicenow:servicenow:san_diego:patch_1:*:*:*:*:*:*san_diego patch_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1:*:*:*:*:*:*san_diego patch_1_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1a:*:*:*:*:*:*san_diego patch_1_hotfix_1aVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1b:*:*:*:*:*:*san_diego patch_1_hotfix_1bVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_2:*:*:*:*:*:*san_diego patch_2VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_2_hotfix_1:*:*:*:*:*:*san_diego patch_2_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_3:*:*:*:*:*:*san_diego patch_3VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_1:*:*:*:*:*:*san_diego patch_3_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_2:*:*:*:*:*:*san_diego patch_3_hotfix_2VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_3:*:*:*:*:*:*san_diego patch_3_hotfix_3VulnerableServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_1:*:*:*:*:*:* Versions san_diego patch_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1:*:*:*:*:*:* Versions san_diego patch_1_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1a:*:*:*:*:*:* Versions san_diego patch_1_hotfix_1a Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_1_hotfix_1b:*:*:*:*:*:* Versions san_diego patch_1_hotfix_1b Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_2:*:*:*:*:*:* Versions san_diego patch_2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_2_hotfix_1:*:*:*:*:*:* Versions san_diego patch_2_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_3:*:*:*:*:*:* Versions san_diego patch_3 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_1:*:*:*:*:*:* Versions san_diego patch_3_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_2:*:*:*:*:*:* Versions san_diego patch_3_hotfix_2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_3:*:*:*:*:*:* Versions san_diego patch_3_hotfix_3 Vulnerable ·ServiceNow
Show 44 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_4:*:*:*:*:*:*san_diego patch_3_hotfix_4VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_4:*:*:*:*:*:*san_diego patch_4VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_4a:*:*:*:*:*:*san_diego patch_4aVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_4b:*:*:*:*:*:*san_diego patch_4bVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_5:*:*:*:*:*:*san_diego patch_5VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_6:*:*:*:*:*:*san_diego patch_6VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_7:*:*:*:*:*:*san_diego patch_7VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_7_hotfix_1:*:*:*:*:*:*san_diego patch_7_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_7_hotfix_2:*:*:*:*:*:*san_diego patch_7_hotfix_2VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_7_hottix_3:*:*:*:*:*:*san_diego patch_7_hottix_3VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_7a:*:*:*:*:*:*san_diego patch_7aVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_7b:*:*:*:*:*:*san_diego patch_7bVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_8:*:*:*:*:*:*san_diego patch_8VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_8_hotfix_1:*:*:*:*:*:*san_diego patch_8_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_8_hotfix_2:*:*:*:*:*:*san_diego patch_8_hotfix_2VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_9:*:*:*:*:*:*san_diego patch_9VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_9a:*:*:*:*:*:*san_diego patch_9aVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_9a_hotfix_1:*:*:*:*:*:*san_diego patch_9a_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:san_diego:patch_9b:*:*:*:*:*:*san_diego patch_9bVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:-:*:*:*:*:*:*tokyoVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch_1:*:*:*:*:*:*tokyo patch_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch_1_hotfix_1:*:*:*:*:*:*tokyo patch_1_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch_1a:*:*:*:*:*:*tokyo patch_1aVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch_1b:*:*:*:*:*:*tokyo patch_1bVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch_2:*:*:*:*:*:*tokyo patch_2VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch_2_hotfix_1:*:*:*:*:*:*tokyo patch_2_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch_2_hotfix_2:*:*:*:*:*:*tokyo patch_2_hotfix_2VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch_2_hotfix_3:*:*:*:*:*:*tokyo patch_2_hotfix_3VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch_2_hotfix_4:*:*:*:*:*:*tokyo patch_2_hotfix_4VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch_3:*:*:*:*:*:*tokyo patch_3VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch_3_hotfix_1:*:*:*:*:*:*tokyo patch_3_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch_3_hotfix_2:*:*:*:*:*:*tokyo patch_3_hotfix_2VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch_3_hotfix_3:*:*:*:*:*:*tokyo patch_3_hotfix_3VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch_3_hotfix_4:*:*:*:*:*:*tokyo patch_3_hotfix_4VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch_4:*:*:*:*:*:*tokyo patch_4VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch_4_hotfix_2:*:*:*:*:*:*tokyo patch_4_hotfix_2VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch_4_hotfix_3:*:*:*:*:*:*tokyo patch_4_hotfix_3VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch_4a:*:*:*:*:*:*tokyo patch_4aVulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch_4a_hotfix_1:*:*:*:*:*:*tokyo patch_4a_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch_5:*:*:*:*:*:*tokyo patch_5VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch_5_hotfix_1:*:*:*:*:*:*tokyo patch_5_hotfix_1VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch_5_hotfix_2:*:*:*:*:*:*tokyo patch_5_hotfix_2VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:tokyo:patch_5_hotfix_3:*:*:*:*:*:*tokyo patch_5_hotfix_3VulnerableServiceNow
cpe:2.3:a:servicenow:servicenow:utah:patch_1:*:*:*:*:*:*utah patch_1VulnerableServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_3_hotfix_4:*:*:*:*:*:* Versions san_diego patch_3_hotfix_4 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_4:*:*:*:*:*:* Versions san_diego patch_4 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_4a:*:*:*:*:*:* Versions san_diego patch_4a Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_4b:*:*:*:*:*:* Versions san_diego patch_4b Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_5:*:*:*:*:*:* Versions san_diego patch_5 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_6:*:*:*:*:*:* Versions san_diego patch_6 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_7:*:*:*:*:*:* Versions san_diego patch_7 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_7_hotfix_1:*:*:*:*:*:* Versions san_diego patch_7_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_7_hotfix_2:*:*:*:*:*:* Versions san_diego patch_7_hotfix_2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_7_hottix_3:*:*:*:*:*:* Versions san_diego patch_7_hottix_3 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_7a:*:*:*:*:*:* Versions san_diego patch_7a Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_7b:*:*:*:*:*:* Versions san_diego patch_7b Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_8:*:*:*:*:*:* Versions san_diego patch_8 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_8_hotfix_1:*:*:*:*:*:* Versions san_diego patch_8_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_8_hotfix_2:*:*:*:*:*:* Versions san_diego patch_8_hotfix_2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_9:*:*:*:*:*:* Versions san_diego patch_9 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_9a:*:*:*:*:*:* Versions san_diego patch_9a Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_9a_hotfix_1:*:*:*:*:*:* Versions san_diego patch_9a_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:san_diego:patch_9b:*:*:*:*:*:* Versions san_diego patch_9b Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:-:*:*:*:*:*:* Versions tokyo Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch_1:*:*:*:*:*:* Versions tokyo patch_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch_1_hotfix_1:*:*:*:*:*:* Versions tokyo patch_1_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch_1a:*:*:*:*:*:* Versions tokyo patch_1a Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch_1b:*:*:*:*:*:* Versions tokyo patch_1b Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch_2:*:*:*:*:*:* Versions tokyo patch_2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch_2_hotfix_1:*:*:*:*:*:* Versions tokyo patch_2_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch_2_hotfix_2:*:*:*:*:*:* Versions tokyo patch_2_hotfix_2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch_2_hotfix_3:*:*:*:*:*:* Versions tokyo patch_2_hotfix_3 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch_2_hotfix_4:*:*:*:*:*:* Versions tokyo patch_2_hotfix_4 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch_3:*:*:*:*:*:* Versions tokyo patch_3 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch_3_hotfix_1:*:*:*:*:*:* Versions tokyo patch_3_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch_3_hotfix_2:*:*:*:*:*:* Versions tokyo patch_3_hotfix_2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch_3_hotfix_3:*:*:*:*:*:* Versions tokyo patch_3_hotfix_3 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch_3_hotfix_4:*:*:*:*:*:* Versions tokyo patch_3_hotfix_4 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch_4:*:*:*:*:*:* Versions tokyo patch_4 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch_4_hotfix_2:*:*:*:*:*:* Versions tokyo patch_4_hotfix_2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch_4_hotfix_3:*:*:*:*:*:* Versions tokyo patch_4_hotfix_3 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch_4a:*:*:*:*:*:* Versions tokyo patch_4a Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch_4a_hotfix_1:*:*:*:*:*:* Versions tokyo patch_4a_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch_5:*:*:*:*:*:* Versions tokyo patch_5 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch_5_hotfix_1:*:*:*:*:*:* Versions tokyo patch_5_hotfix_1 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch_5_hotfix_2:*:*:*:*:*:* Versions tokyo patch_5_hotfix_2 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:tokyo:patch_5_hotfix_3:*:*:*:*:*:* Versions tokyo patch_5_hotfix_3 Vulnerable ·ServiceNow
  • cpe:2.3:a:servicenow:servicenow:utah:patch_1:*:*:*:*:*:* Versions utah patch_1 Vulnerable ·ServiceNow

Remediation

  • Fix · CNA Now User Experience (ServiceNow) Fixed in San Diego Patch 10, Tokyo Patch 4b, Tokyo Patch 6, Utah Patch 1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-1298
  2. 2026-10-03 Alias added: GHSA-vrrx-r38v-p3m7

References

Advisory 1

Other 1

  • TI-2024-04841 Incomplete Input Validation in GlideExpression Script KEVCVSS 4.0CRITICAL 9.2
  • TI-2024-04536 Jelly Template Injection Vulnerability in ServiceNow UI Macros KEVCVSS 4.0CRITICAL 9.3
  • TI-2024-08286 Sandbox Escape in Now Platform CVSS 4.0CRITICAL 9.3
  • TI-2022-21442 ACL bypass in Reporting functionality CVSS 3.1CRITICAL 9.9
  • TI-2024-08287 Unauthenticated Blind SQL Injection in Core Platform CVSS 4.0HIGH 8.7
  • TI-2018-05591 report_viewer.do in ServiceNow Release Jakarta Patch 8 and earlier allows remote… CVSS 3.0HIGH 8.8
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences