CVE-2022-42704: XSS

Published Jan 12, 2023

Updated

A cross-site scripting (XSS) vulnerability in Employee Service Center (esc) and Service Portal (sp) in ServiceNow Quebec, Rome, and San Diego allows remote attackers to inject arbitrary web script via the Standard Ticket Conversations widget.

Affected Software

7 affected components

ServiceNow ServiceNow=quebec

ServiceNow ServiceNow=rome

ServiceNow ServiceNow=rome-patch_1

ServiceNow ServiceNow=rome-patch_2

ServiceNow ServiceNow=rome-patch_3

ServiceNow ServiceNow=rome-patch_4

ServiceNow ServiceNow=san_diego

Remediation

Patch Available

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1216141

Event History

Jan 12, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is CVE-2022-42704?

CVE-2022-42704 is a cross-site scripting (XSS) vulnerability in Employee Service Center (esc) and Service Portal (sp) in ServiceNow Quebec, Rome, and San Diego.

How does CVE-2022-42704 impact ServiceNow?

CVE-2022-42704 allows remote attackers to inject arbitrary web script via the Standard Ticket Conversations widget.

Which versions of ServiceNow are affected by CVE-2022-42704?

CVE-2022-42704 affects ServiceNow versions Quebec, Rome, and San Diego.

What is the severity of CVE-2022-42704?

CVE-2022-42704 has a severity rating of medium with a CVSS score of 5.4.

How can I fix the CVE-2022-42704 vulnerability?

To fix the CVE-2022-42704 vulnerability, apply the necessary patches provided by ServiceNow and follow their recommendations.