CVE-2025-0337

published 2025-03-06

CVE-2025-0337: ServiceNow has addressed an authorization bypass vulnerability that was identified in the Washington release of the Now Platform. This vulnerability, if…

Priority P3 38 medium 6.5 CVSS 3.1

AV N AC L PR L UI N S U C H I N A N

ServiceNow has addressed an authorization bypass vulnerability that was identified in the Washington release of the Now Platform. This vulnerability, if exploited, potentially could enable an authenticated user to access unauthorized data stored within the Now Platform that the user otherwise would not be entitled to access.

This issue is addressed in the listed patches and family release, which have been made available to hosted and self-hosted customers, as well as partners.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
servicenow	now_platform	< Washington DC Patch 9	Washington DC Patch 9
servicenow	now_platform	< Xanadu Patch 4	Xanadu Patch 4
servicenow	now_platform	< Yokohama	Yokohama

CVSS provenance

nvd v3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

nvd v4.0 7.1 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-639