CVE-2022-46389

Cross-Site Scripting (XSS) vulnerability found on logout functionality

MEDIUM

6.1

CVSS Score

Published: April 17, 2023 at 12:00 AM UTC

Updated: June 17, 2026 at 05:11 AM UTC

1 product affected across 1 vendorServiceNow

Using Now Platform by ServiceNow?

Get instant alerts when new vulnerabilities affect Now Platform - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM6.1

Exploit prediction

EPSS 0.6%

SSVC

No known exploit

Description

There exists a reflected XSS within the logout functionality of ServiceNow versions lower than Quebec Patch 10 Hotfix 11b, Rome Patch 10 Hotfix 3b, San Diego Patch 9, Tokyo Patch 4, and Utah GA. This enables an unauthenticated remote attacker to execute arbitrary JavaScript code in the browser-based web console.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

ServiceNow · Servicenow

95%

Quebec ≤ v < Patch 10 Hotfix 11bRome ≤ v < Patch 10 Hotfix 3bSan Diego ≤ v < Patch 9Tokyo ≤ v < Patch 4Utah ≤ v < GAQuebecRome San DiegoTokyoUtahquebecromerome early_availability rome patch_1 rome patch_10 rome patch_1_hotfix_1a rome patch_1_hotfix_1b rome patch_2 rome patch_3 rome patch_4 rome patch_4_hotfix_1 rome patch_4_hotfix_1a rome patch_4_hotfix_1b rome patch_5 rome patch_6 rome patch_7 rome patch_7a rome patch_7b rome patch_8 rome patch_9 rome patch_9asan_diegosan_diego patch_1 san_diego patch_1_hotfix_1 san_diego patch_1_hotfix_1a san_diego patch_1_hotfix_1b san_diego patch_2 san_diego patch_3 san_diego patch_4 san_diego patch_4a san_diego patch_4b san_diego patch_5 san_diego patch_6 san_diego patch_7 san_diego patch_7b san_diego patch_8 tokyo tokyo early_availability tokyo patch_1 tokyo patch_1a tokyo patch_1b tokyo patch_2 tokyo patch_3 utah utah early_availability utah patch_1 utah patch_2

Affected range stops below GA, so it looks safe — our inference, not a vendor statement

Affected range stops below Patch 10 Hotfix 11b, so it looks safe — our inference, not a vendor statement

Affected range stops below Patch 10 Hotfix 3b, so it looks safe — our inference, not a vendor statement

Affected range stops below Patch 4, so it looks safe — our inference, not a vendor statement

Affected range stops below Patch 9, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1272156

References (1)

Vendor Advisory

Source: [email protected]

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1272156

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

6.1MEDIUMSN

Attack Vector: NETWORK
Complexity: LOW
Privileges: NONE
User Interaction: REQUIRED
Scope: CHANGED
Confidentiality: LOW
Integrity: LOW
Availability: NONE

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-79

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card