CVE-2022-39048: Cross-Site Scripting (XSS) vulnerability in ServiceNow UI page assessment_redirect
A XSS vulnerability was identified in the ServiceNow UI page assessmentredirect. To exploit this vulnerability, an attacker would need to persuade an authenticated user to click a maliciously crafted URL. Successful exploitation potentially could be used to conduct various client-side attacks, including, but not limited to, phishing, redirection, theft of CSRF tokens, and use of an authenticated user's browser or session to attack other systems.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-39048?
CVE-2022-39048 is classified as a medium severity vulnerability.
How does CVE-2022-39048 impact users?
CVE-2022-39048 allows an attacker to execute cross-site scripting (XSS) attacks by persuading users to click maliciously crafted URLs.
How do I fix CVE-2022-39048?
To remediate CVE-2022-39048, you should update to the latest patched version of ServiceNow.
Who is affected by CVE-2022-39048?
CVE-2022-39048 affects multiple versions of ServiceNow, specifically Quebec, Rome, San Diego, and Tokyo.
What is the exploit vector for CVE-2022-39048?
CVE-2022-39048 can be exploited through crafted URLs that target authenticated users.