CVE-2023-1298

Description

ServiceNow has released upgrades and patches that address a Reflected Cross-Site scripting (XSS) vulnerability that was identified in the ServiceNow Polaris Layout. This vulnerability would enable an authenticated user to inject arbitrary scripts.

Reserved 2023-03-09 | Published 2023-07-06 | Updated 2024-10-21 | Assigner SN

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

Default status
unaffected

Any version before San Diego Patch 10
affected

Any version before Tokyo Patch 4b
affected

Any version before Tokyo Patch 6
affected

Any version before Utah Patch 1
affected

Credits

Osama Yousef finder

References

support.servicenow.com/...cle_view&sysparm_article=KB1310230 vendor-advisory

www.linkedin.com/in/osamay/

cve.org (CVE-2023-1298)

nvd.nist.gov (CVE-2023-1298)

Download JSON