vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2022-43684

ACL bypass in Reporting functionality

MEDIUM
6.5
CVSS Score
Published: June 13, 2023 at 06:51 PM UTC
Updated: June 17, 2026 at 05:07 AM UTC
1 product affected across 1 vendorServiceNow

Using Now Platform by ServiceNow?

Get instant alerts when new vulnerabilities affect Now Platform - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM6.5
Exploit prediction
EPSS 2%
SSVC
No known exploit

Description

ServiceNow has released patches and an upgrade that address an Access Control List (ACL) bypass issue in ServiceNow Core functionality. Additional Details This issue is present in the following supported ServiceNow releases: * Quebec prior to Patch 10 Hot Fix 8b * Rome prior to Patch 10 Hot Fix 1 * San Diego prior to Patch 7 * Tokyo prior to Tokyo Patch 1; and * Utah prior to Utah General Availability If this ACL bypass issue were to be successfully exploited, it potentially could allow an authenticated user to obtain sensitive information from tables missing authorization controls.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

ServiceNow· Servicenow
95%
Quebec ≤ v < Patch 10 Hot Fix 8bRome ≤ v < Patch 10 Hot Fix 1San Diego ≤ v < Patch 7Tokyo ≤ v < Tokyo Patch 1Utah ≤ v < Utah General Availability (GA)QuebecRomeSan DiegoTokyoUtahquebec patch_10quebec patch_10_hotfix_3quebec patch_10_hotfix_3aquebec patch_10_hotfix_3bquebec patch_10_hotfix_4quebec patch_1_hotfix_1quebec patch_2quebec patch_2_hotfix_1quebec patch_2_hotfix_2quebec patch_3quebec patch_4quebec patch_4_hotfix_2quebec patch_5quebec patch_6quebec patch_7quebec patch_8quebec patch_9rome patch_1rome patch_10rome patch_1_hotfix_1rome patch_1_hotfix_1arome patch_1_hotfix_1brome patch_1_hotfix_2rome patch_1_hotfix_3rome patch_2rome patch_2_hotfix_1rome patch_2_hotfix_2rome patch_3rome patch_3_hotfix_1rome patch_4rome patch_4_hotfix_1rome patch_4_hotfix_1arome patch_4_hotfix_1brome patch_5rome patch_5_hotfix_1rome patch_5_hotfix_2rome patch_6rome patch_6_hotfix_1rome patch_6_hotfix_2rome patch_7rome patch_7_hotfix_1rome patch_7arome patch_7brome patch_8rome patch_8_hotfix_1rome patch_8_hotfix_2rome patch_9rome patch_9_hotfix_1rome patch_9arome patch_9bsan_diego patch_1san_diego patch_10_hotfix_1san_diego patch_10_hotfix_1asan_diego patch_10_hotfix_1bsan_diego patch_10_hotfix_2san_diego patch_10_hotfix_2bsan_diego patch_1_hotfix_1san_diego patch_1_hotfix_1asan_diego patch_1_hotfix_1bsan_diego patch_2san_diego patch_2_hotfix_1san_diego patch_3san_diego patch_3_hotfix_1san_diego patch_3_hotfix_2san_diego patch_3_hotfix_3san_diego patch_3_hotfix_4san_diego patch_4san_diego patch_4asan_diego patch_4bsan_diego patch_5san_diego patch_6tokyoutah
Affected range stops below Patch 10 Hot Fix 1, so it looks safe — our inference, not a vendor statement
Affected range stops below Patch 10 Hot Fix 8b, so it looks safe — our inference, not a vendor statement
Affected range stops below Patch 7, so it looks safe — our inference, not a vendor statement
Affected range stops below Tokyo Patch 1, so it looks safe — our inference, not a vendor statement
Affected range stops below Utah General Availability (GA), so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (5)

Source: [email protected]
http://packetstormsecurity.com/files/173354/ServiceNow-Insecure-Access-Control-Full-Admin-Compromise.html
Source: [email protected]
http://seclists.org/fulldisclosure/2023/Jul/11
Source: [email protected]
https://news.ycombinator.com/item?id=36638530
Vendor Advisory
Source: [email protected]
https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1303489
Source: [email protected]
https://x64.sh/posts/ServiceNow-Insecure-access-control-to-admin/

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

6.5MEDIUM[email protected]
Attack Vector
NETWORK
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-200CWE-668

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card