CVE-2022-43684: ServiceNow has released patches and an upgrade that address an Access Control List (ACL) bypass issue in ServiceNow Core functionality. Additional Details This…

PriorityP339medium6.5CVSS 3.1

AVNACLPRLUINSUCHINAN

EPSS

1.80%

75.8th percentile

ServiceNow has released patches and an upgrade that address an Access Control List (ACL) bypass issue in ServiceNow Core functionality.


Additional Details

This issue is present in the following supported ServiceNow releases:


* Quebec prior to Patch 10 Hot Fix 8b
* Rome prior to Patch 10 Hot Fix 1
* San Diego prior to Patch 7
* Tokyo prior to Tokyo Patch 1; and
* Utah prior to Utah General Availability


If this ACL bypass issue were to be successfully exploited, it potentially could allow an authenticated user to obtain sensitive information from tables missing authorization controls.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
servicenow	now_platform	>= Quebec < Patch 10 Hot Fix 8b	Patch 10 Hot Fix 8b
servicenow	now_platform	>= Rome < Patch 10 Hot Fix 1	Patch 10 Hot Fix 1
servicenow	now_platform	>= San Diego < Patch 7	Patch 7
servicenow	now_platform	>= Tokyo < Tokyo Patch 1	Tokyo Patch 1
servicenow	now_platform	>= Utah < Utah General Availability (GA)	Utah General Availability (GA)
servicenow	servicenow	—	—
servicenow	servicenow	—	—
servicenow	servicenow	—	—
servicenow	servicenow	—	—
servicenow	servicenow	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.