Lucene search

SNCVELIST:CVE-2022-43684

HistoryJun 13, 2023 - 6:51 p.m.

CVE-2022-43684 ACL bypass in Reporting functionality

2023-06-1318:51:39

CWE-200

www.cve.org

servicenow

acl bypass

patched

authorization controls

CVSS3

9.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.001

Percentile

44.3%

JSON

ServiceNow has released patches and an upgrade that address an Access Control List (ACL) bypass issue in ServiceNow Core functionality.

Additional Details

This issue is present in the following supported ServiceNow releases:

Quebec prior to Patch 10 Hot Fix 8b
Rome prior to Patch 10 Hot Fix 1
San Diego prior to Patch 7
Tokyo prior to Tokyo Patch 1; and
Utah prior to Utah General Availability

If this ACL bypass issue were to be successfully exploited, it potentially could allow an authenticated user to obtain sensitive information from tables missing authorization controls.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Now Platform",
    "vendor": "ServiceNow",
    "versions": [
      {
        "lessThan": "Patch 10 Hot Fix 8b",
        "status": "affected",
        "version": "Quebec",
        "versionType": "custom"
      },
      {
        "lessThan": "Patch 10 Hot Fix 1",
        "status": "affected",
        "version": "Rome",
        "versionType": "custom"
      },
      {
        "lessThan": "Patch 7",
        "status": "affected",
        "version": "San Diego",
        "versionType": "custom"
      },
      {
        "lessThan": "Tokyo Patch 1",
        "status": "affected",
        "version": "Tokyo",
        "versionType": "custom"
      },
      {
        "lessThan": "Utah General Availability (GA)",
        "status": "affected",
        "version": "Utah",
        "versionType": "custom"
      }
    ]
  }
]

References

packetstormsecurity.com/files/173354/ServiceNow-Insecure-Access-Control-Full-Admin-Compromise.html

seclists.org/fulldisclosure/2023/Jul/11

news.ycombinator.com/item?id=36638530

support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1303489

x64.sh/posts/ServiceNow-Insecure-access-control-to-admin/

CVSS3

9.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.001

Percentile

44.3%

JSON

Related for CVELIST:CVE-2022-43684