CVE-2023-1298

Published Jul 6, 2023 CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Description
ServiceNow has released upgrades and patches that address a Reflected Cross-Site scripting (XSS) vulnerability that was identified in the ServiceNow Polaris Layout. This vulnerability would enable an authenticated user to inject arbitrary scripts.

Analysis

No analysis available yet

Remediation

No remediation available yet

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2023-23561 ServiceNow has released upgrades and patches that address a Reflected Cross-Site scripting (XSS) vulnerability that was identified in the ServiceNow Polaris Layout. This vulnerability would enable an authenticated user to inject arbitrary scripts.
History
Type Values Removed Values Added
CPEs cpe:2.3:a:servicenow:servicenow:utah:patch1:*:*:*:*:*:* cpe:2.3:a:servicenow:servicenow:utah:patch_1:*:*:*:*:*:*
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
SN
Published
Updated
Oct 21, 2024, 9:11 PM
Reserved
Mar 9, 2023, 7:33 PM
Status
Modified
Published
Jul 6, 2023, 6:15 PM
Modified
Jun 17, 2026, 5:27 AM