CVE-2022-46886: Medium severity servicenow vulnerability

Published Apr 14, 2023
·
Updated

There exists an open redirect within the response list update functionality of ServiceNow. This allows attackers to redirect users to arbitrary domains when clicking on a URL within a service-now domain.

Affected Software

56 affected components
ServiceNow ServiceNow=quebec
ServiceNow ServiceNow=quebec-patch_10
ServiceNow ServiceNow=rome-patch_1
ServiceNow ServiceNow=rome-patch_1_hotfix_1
ServiceNow ServiceNow=rome-patch_1_hotfix_1b
ServiceNow ServiceNow=rome-patch_1_hotfix_2
ServiceNow ServiceNow=rome-patch_1_hotfix_3
ServiceNow ServiceNow=rome-patch_10
ServiceNow ServiceNow=rome-patch_10_hotfix_1
ServiceNow ServiceNow=rome-patch_10_hotfix_2
ServiceNow ServiceNow=rome-patch_10_hotfix_2a
ServiceNow ServiceNow=rome-patch_2
ServiceNow ServiceNow=rome-patch_2_hotfix_1
ServiceNow ServiceNow=rome-patch_2_hotfix_2
ServiceNow ServiceNow=rome-patch_3
ServiceNow ServiceNow=rome-patch_3_hotfix_1
ServiceNow ServiceNow=rome-patch_4
ServiceNow ServiceNow=rome-patch_4_hotfix_1
ServiceNow ServiceNow=rome-patch_4_hotfix_1a
ServiceNow ServiceNow=rome-patch_4_hotfix_1b
ServiceNow ServiceNow=rome-patch_5
ServiceNow ServiceNow=rome-patch_5_hotfix_1
ServiceNow ServiceNow=rome-patch_5_hotfix_2
ServiceNow ServiceNow=rome-patch_6
ServiceNow ServiceNow=rome-patch_6_hotfix_1
ServiceNow ServiceNow=rome-patch_6_hotfix_2
ServiceNow ServiceNow=rome-patch_7
ServiceNow ServiceNow=rome-patch_7_hotfix_1
ServiceNow ServiceNow=rome-patch_7a
ServiceNow ServiceNow=rome-patch_7b
ServiceNow ServiceNow=rome-patch_8
ServiceNow ServiceNow=rome-patch_8_hotfix_1
ServiceNow ServiceNow=rome-patch_8_hotfix_2
ServiceNow ServiceNow=rome-patch_9
ServiceNow ServiceNow=rome-patch_9_hotfix_1
ServiceNow ServiceNow=rome-patch_9a
ServiceNow ServiceNow=rome-patch_9b
ServiceNow ServiceNow=san_diego-patch_1
ServiceNow ServiceNow=san_diego-patch_1_hotfix_1
ServiceNow ServiceNow=san_diego-patch_1_hotfix_1a
ServiceNow ServiceNow=san_diego-patch_1_hotfix_1b
ServiceNow ServiceNow=san_diego-patch_2
ServiceNow ServiceNow=san_diego-patch_2_hotfix_1
ServiceNow ServiceNow=san_diego-patch_3
ServiceNow ServiceNow=san_diego-patch_3_hotfix_1
ServiceNow ServiceNow=san_diego-patch_3_hotfix_2
ServiceNow ServiceNow=san_diego-patch_3_hotfix_3
ServiceNow ServiceNow=san_diego-patch_3_hotfix_4
ServiceNow ServiceNow=san_diego-patch_4
ServiceNow ServiceNow=san_diego-patch_4a
ServiceNow ServiceNow=san_diego-patch_4b
ServiceNow ServiceNow=san_diego-patch_6
ServiceNow ServiceNow=san_diego-patch_7
ServiceNow ServiceNow=san_diego-patch_8
ServiceNow ServiceNow=tokyo
ServiceNow ServiceNow=tokyo-patch1

Event History

Apr 14, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:15 PM
DescriptionSeverityWeaknessAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2022-46886?

CVE-2022-46886 is classified with a high severity, as it allows for open redirection vulnerabilities.

2

How do I fix CVE-2022-46886?

To fix CVE-2022-46886, ensure you update to the latest patched version of ServiceNow that addresses this vulnerability.

3

What software versions are affected by CVE-2022-46886?

CVE-2022-46886 affects multiple versions of ServiceNow including Quebec, Rome, and San Diego branches.

4

What is an open redirect vulnerability in CVE-2022-46886?

An open redirect vulnerability like CVE-2022-46886 allows attackers to redirect users to malicious external websites via crafted URLs.

5

How can CVE-2022-46886 impact users?

CVE-2022-46886 can lead to phishing attacks, as users may be unknowingly redirected to harmful websites.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203