Paper/Archive/CVE-2022-43684

CVE-2022-43684

ServiceNow Now Platform — ACL bypass in Reporting functionality

CVSS 9.9 (CNA)9.9 / 10 × 3029.7 Not in CISA KEV+300.0 EPSS percentile 78.5.785 × 2015.7 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

ServiceNow has released patches and an upgrade that address an Access Control List (ACL) bypass issue in ServiceNow Core functionality. Additional Details This issue is present in the following supported ServiceNow releases: * Quebec prior to Patch 10 Hot Fix 8b * Rome prior to Patch 10 Hot Fix 1 * San Diego prior to Patch 7 * Tokyo prior to Tokyo Patch 1; and * Utah prior to Utah General Availability If this ACL bypass issue were to be successfully exploited, it potentially could allow an authenticated user to obtain sensitive information from tables missing authorization controls.

Affected

ProductAffectedFixed inSource

Now PlatformQuebec – < Patch 10 Hot Fix 8bPatch 10 Hot Fix 8bCNA

Now PlatformRome – < Patch 10 Hot Fix 1Patch 10 Hot Fix 1CNA

Now PlatformSan Diego – < Patch 7Patch 7CNA

Now PlatformTokyo – < Tokyo Patch 1Tokyo Patch 1CNA

Now PlatformUtah – < Utah General Availability (GA)Utah General Availability (GA)CNA

Scores by source

SN (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refsupport.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1303489 refseclists.org/fulldisclosure/2023/Jul/11 refnews.ycombinator.com/item?id=36638530 refx64.sh/posts/ServiceNow-Insecure-access-control-to-admin refpacketstormsecurity.com/files/173354/ServiceNow-Insecure-Access-Control-Full-Admin-Compromise.html