{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-42704", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-08-03T13:10:41.436Z", "dateReserved": "2022-10-10T00:00:00", "datePublished": "2023-01-12T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2023-01-12T00:00:00"}, "descriptions": [{"lang": "en", "value": "A cross-site scripting (XSS) vulnerability in Employee Service Center (esc) and Service Portal (sp) in ServiceNow Quebec, Rome, and San Diego allows remote attackers to inject arbitrary web script via the Standard Ticket Conversations widget."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1216141"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T13:10:41.436Z"}, "title": "CVE Program Container", "references": [{"url": "https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1216141", "tags": ["x_transferred"]}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:servicenow:servicenow:quebec:*:*:*:*:*:*:*", "matchCriteriaId": "412004C5-93F0-4EC0-B928-E6F41AB95FBE", "vulnerable": true}, {"criteria": "cpe:2.3:a:servicenow:servicenow:rome:*:*:*:*:*:*:*", "matchCriteriaId": "001789AB-E56B-4D04-B1B4-DD326A0CB1C9", "vulnerable": true}, {"criteria": "cpe:2.3:a:servicenow:servicenow:rome:patch_1:*:*:*:*:*:*", "matchCriteriaId": "52C8A7D2-F930-4078-9E9D-E48782E46CBD", "vulnerable": true}, {"criteria": "cpe:2.3:a:servicenow:servicenow:rome:patch_2:*:*:*:*:*:*", "matchCriteriaId": "EAA82A56-93C2-47DC-92BA-D2EBF0C19EEC", "vulnerable": true}, {"criteria": "cpe:2.3:a:servicenow:servicenow:rome:patch_3:*:*:*:*:*:*", "matchCriteriaId": "B053530E-1CB3-4A86-BD4B-569750776A53", "vulnerable": true}, {"criteria": "cpe:2.3:a:servicenow:servicenow:rome:patch_4:*:*:*:*:*:*", "matchCriteriaId": "00EE16EE-B759-4BD8-A30B-C952142C860E", "vulnerable": true}, {"criteria": "cpe:2.3:a:servicenow:servicenow:san_diego:*:*:*:*:*:*:*", "matchCriteriaId": "0332F3A4-ABA4-4EE1-955C-C4B4B2B3C881", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A cross-site scripting (XSS) vulnerability in Employee Service Center (esc) and Service Portal (sp) in ServiceNow Quebec, Rome, and San Diego allows remote attackers to inject arbitrary web script via the Standard Ticket Conversations widget."}, {"lang": "es", "value": "Una vulnerabilidad de cross-site scripting (XSS) en el Employee Service Center (esc) y Service Portal (sp) en ServiceNow Quebec, Roma y San Diego permite a atacantes remotos inyectar scripts web arbitrario a trav\u00e9s del widget Standard Ticket Conversations."}], "id": "CVE-2022-42704", "lastModified": "2023-01-23T18:36:41.117", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-01-13T00:15:09.563", "references": [{"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1216141"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}