CVE-2022-39048
Published: 10 April 2023
Summary
CVE-2022-39048 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Servicenow Servicenow. Its CVSS base score is 6.1 (Medium).
Operationally, ranked in the top 4.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
A cross-site scripting vulnerability exists in the ServiceNow UI page assessment_redirect and is tracked as CVE-2022-39048. The flaw is classified under CWE-79 and carries a CVSS 3.1 score of 6.1, reflecting network attack vector, low attack complexity, no required privileges, required user interaction, and changed scope with limited impacts on confidentiality and integrity.
An unauthenticated attacker can exploit the issue by crafting a malicious URL and persuading an authenticated ServiceNow user to click it. Successful exploitation allows client-side attacks such as phishing, redirection, theft of CSRF tokens, or leveraging the victim’s authenticated browser session to target other systems.
ServiceNow has published mitigation guidance in knowledge-base article KB1221892, available through the vendor’s support portal at support.servicenow.com. The EPSS score for this CVE reached a peak of 0.2745 before receding to its current value of 0.1698.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-41594
Vulnerability details
A XSS vulnerability was identified in the ServiceNow UI page assessment_redirect. To exploit this vulnerability, an attacker would need to persuade an authenticated user to click a maliciously crafted URL. Successful exploitation potentially could be used to conduct various client-side…
more
attacks, including, but not limited to, phishing, redirection, theft of CSRF tokens, and use of an authenticated user's browser or session to attack other systems.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.