Broken Access Control in ServiceNow AI Platform
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in Washington DC Patch 10 Hot Fix 2a, Xanadu Patch 7a, Xanadu Patch 8, Yokohama Patch 1a, Yokohama Patch 2
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
ServiceNow has addressed a Broken Access Control vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could allow a low privileged user to bypass access controls and perform a limited set of actions typically reserved for higher privileged users, potentially leading to unauthorized data modifications. This issue is addressed in the listed patches and family releases, which have been made available to hosted and self-hosted customers, as well as partners.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- ServiceNow ServiceNow AI Platform
From Aspen · fixed in Washington DC Patch 10 Hot Fix 2a; From Aspen · fixed in Xanadu Patch 7a; From Aspen · fixed in Xanadu Patch 8; From Aspen · fixed in Yokohama Patch 1a; From Aspen · fixed in Yokohama Patch 2