Skip to main content

Servicenow CVE-2023-1209

MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2023-05-23 psirt@servicenow.com
XSS Servicenow
5.4
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.4 MEDIUM
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

1
CVE Published
May 23, 2023 - 17:15 nvd
MEDIUM 5.4

DescriptionNVD

Cross-Site Scripting (XSS) vulnerabilities exist in ServiceNow records allowing an authenticated attacker to inject arbitrary scripts.

AnalysisAI

Cross-Site Scripting (XSS) vulnerabilities exist in ServiceNow records allowing an authenticated attacker to inject arbitrary scripts. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. Cross-Site Scripting (XSS) vulnerabilities exist in ServiceNow records allowing an authenticated attacker to inject arbitrary scripts. Affected products include: Servicenow.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.

More in Servicenow

View all
CVE-2024-4879 CRITICAL POC
9.3 Jul 10

ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platfo
CVE-2024-5217 CRITICAL POC
9.2 Jul 10

ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earl
CVE-2018-7748 HIGH POC
8.8 Aug 03

report_viewer.do in ServiceNow Release Jakarta Patch 8 and earlier allows remote attackers to execute arbitrary code via
CVE-2022-38463 MEDIUM POC
6.1 Aug 23

ServiceNow through San Diego Patch 4b and Patch 6 allows reflected XSS in the logout functionality. Rated medium severit
CVE-2024-8923 CRITICAL
9.3 Oct 29

ServiceNow has addressed an input validation vulnerability that was identified in the Now Platform. Rated critical sever
CVE-2024-8924 HIGH
8.7 Oct 29

ServiceNow has addressed a blind SQL injection vulnerability that was identified in the Now Platform. Rated high severit
CVE-2023-1298 MEDIUM
6.1 Jul 06

ServiceNow has released upgrades and patches that address a Reflected Cross-Site scripting (XSS) vulnerability that was

CVE-2022-38172 MEDIUM
6.1 Aug 23

ServiceNow through San Diego Patch 3 allows XSS via the name field during creation of a new dashboard for the Performanc

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4
CVE-2015-0072 MEDIUM POC
4.3

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8
CVE-2016-8581 MEDIUM POC
6.1

Share

CVE-2023-1209 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy