CVE-2019-20768: XSS
Published May 5, 2020
·Updated
ServiceNow IT Service Management Kingston through Patch 14-1, London through Patch 7, and Madrid before patch 4 allow stored XSS via crafted sysparmitemguid and sysid parameters in an Incident Request to servicecatalog.do.
Affected Software
66 affected components
ServiceNow IT Service Management=kingston
ServiceNow IT Service Management=kingston-patch_1
ServiceNow IT Service Management=kingston-patch_10
ServiceNow IT Service Management=kingston-patch_10-1
ServiceNow IT Service Management=kingston-patch_10-2
ServiceNow IT Service Management=kingston-patch_11
ServiceNow IT Service Management=kingston-patch_12
ServiceNow IT Service Management=kingston-patch_12-1
ServiceNow IT Service Management=kingston-patch_12-2
ServiceNow IT Service Management=kingston-patch_13
ServiceNow IT Service Management=kingston-patch_14
ServiceNow IT Service Management=kingston-patch_14-1
ServiceNow IT Service Management=kingston-patch_2
ServiceNow IT Service Management=kingston-patch_3
ServiceNow IT Service Management=kingston-patch_3-1
ServiceNow IT Service Management=kingston-patch_3-2
ServiceNow IT Service Management=kingston-patch_3a-1
ServiceNow IT Service Management=kingston-patch_4
ServiceNow IT Service Management=kingston-patch_4-1
ServiceNow IT Service Management=kingston-patch_4-2
ServiceNow IT Service Management=kingston-patch_4-4
ServiceNow IT Service Management=kingston-patch_5
ServiceNow IT Service Management=kingston-patch_6
ServiceNow IT Service Management=kingston-patch_6-1
ServiceNow IT Service Management=kingston-patch_6-2
ServiceNow IT Service Management=kingston-patch_6-3
ServiceNow IT Service Management=kingston-patch_6-5
ServiceNow IT Service Management=kingston-patch_7
ServiceNow IT Service Management=kingston-patch_7-1
ServiceNow IT Service Management=kingston-patch_8
ServiceNow IT Service Management=kingston-patch_8-1
ServiceNow IT Service Management=kingston-patch_9
ServiceNow IT Service Management=london
ServiceNow IT Service Management=london-patch_1
ServiceNow IT Service Management=london-patch_1-2
ServiceNow IT Service Management=london-patch_1-3
ServiceNow IT Service Management=london-patch_2
ServiceNow IT Service Management=london-patch_2-2
ServiceNow IT Service Management=london-patch_2-4
ServiceNow IT Service Management=london-patch_2-5
ServiceNow IT Service Management=london-patch_3
ServiceNow IT Service Management=london-patch_3-3
ServiceNow IT Service Management=london-patch_3-4
ServiceNow IT Service Management=london-patch_4
ServiceNow IT Service Management=london-patch_4-1
ServiceNow IT Service Management=london-patch_4-2
ServiceNow IT Service Management=london-patch_4-3
ServiceNow IT Service Management=london-patch_4-4
ServiceNow IT Service Management=london-patch_4-5
ServiceNow IT Service Management=london-patch_4-6
ServiceNow IT Service Management=london-patch_5
ServiceNow IT Service Management=london-patch_5-1
ServiceNow IT Service Management=london-patch_6
ServiceNow IT Service Management=london-patch_6-1
ServiceNow IT Service Management=london-patch_6a-1
ServiceNow IT Service Management=london-patch_6b-1
ServiceNow IT Service Management=london-patch_7
ServiceNow IT Service Management=madrid
ServiceNow IT Service Management=madrid-patch_0-1
ServiceNow IT Service Management=madrid-patch_1
ServiceNow IT Service Management=madrid-patch_1-1
ServiceNow IT Service Management=madrid-patch_1-2
ServiceNow IT Service Management=madrid-patch_2
ServiceNow IT Service Management=madrid-patch_3
ServiceNow IT Service Management=madrid-patch_3-1
ServiceNow IT Service Management=madrid-patch_3-2
Event History
May 5, 2020
CVE Published
via MITRE·09:13 PM
Data Sourced
via MITRE·09:13 PM
Description
Frequently Asked Questions
1
What is CVE-2019-20768?
CVE-2019-20768 refers to Stored XSS vulnerability in ServiceNow IT Service Management versions Kingston through Patch 14-1, London through Patch 7, and Madrid before patch 4.
2
How severe is CVE-2019-20768?
The severity of CVE-2019-20768 is rated as medium with a CVSS score of 5.4.
3
What is the affected software for CVE-2019-20768?
The affected software includes ServiceNow IT Service Management versions Kingston through Patch 14-1, London through Patch 7, and Madrid before patch 4.
4
How can the stored XSS vulnerability be exploited in CVE-2019-20768?
The vulnerability can be exploited via crafted sysparm_item_guid and sys_id parameters in an Incident Request to service_catalog.do.
5
Are there any references for CVE-2019-20768?
Yes, references for CVE-2019-20768 include responsible disclosure details and related blog posts.