CVE-2022-39048: A XSS vulnerability was identified in the ServiceNow UI page assessment_redirect. To exploit this vulnerability, an attacker would need to persuade an…

PriorityP335medium6.1CVSS 3.1

AVNACLPRNUIRSCCLILAN

EXPLOIT

EPSS

1.09%

61.2th percentile

A XSS vulnerability was identified in the ServiceNow UI page assessment_redirect. To exploit this vulnerability, an attacker would need to persuade an authenticated user to click a maliciously crafted URL. Successful exploitation potentially could be used to conduct various client-side attacks, including, but not limited to, phishing, redirection, theft of CSRF tokens, and use of an authenticated user's browser or session to attack other systems.

Affected

9 ranges

Vendor	Product	Version range	Fixed in
servicenow	now_platform	>= Quebec < Patch 10 Hotfix 10b	Patch 10 Hotfix 10b
servicenow	now_platform	>= Rome < Patch 10 Hotfix 2b	Patch 10 Hotfix 2b
servicenow	now_platform	>= San Diego < Patch 7b	Patch 7b
servicenow	now_platform	>= Tokyo < Patch 1a	Patch 1a
servicenow	servicenow	—	—
servicenow	servicenow	—	—
servicenow	servicenow	—	—
servicenow	servicenow	—	—
servicenow	servicenow	—	—

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.