PT-2025-9977 · Servicenow · Servicenow

Jean-Michel Huguet + 1 · Publicado 2025-03-06 · Atualizado 2025-05-09 · CVE-2025-0337

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ServiceNow versions prior to the fixed version in the Washington release of Now Platform

Description The issue is an authorization bypass vulnerability that could enable an authenticated user to access unauthorized data stored within the Now Platform. It is estimated that over 481,000 instances may be affected.

Recommendations For versions prior to the fixed version in the Washington release of Now Platform, update to the latest patch or family release that addresses this issue. As a temporary workaround, consider restricting access to sensitive data within the Now Platform until a patch is applied.

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2025-0337

Produtos afetados

Servicenow

Referências · 16

• https://twitter.com/fletch_ai/status/1899339635387736117 · Publicação no Twitter
• https://twitter.com/Komodosec/status/1920660039767126340 · Publicação no Twitter
• https://twitter.com/fridaysecurity/status/1898189263008620695 · Publicação no Twitter
• https://twitter.com/HunterMapping/status/1899279031922737425 · Publicação no Twitter
• https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1948695 · Nota
• https://twitter.com/Dinosn/status/1898211619902992478 · Publicação no Twitter
• https://twitter.com/cybercronai/status/1898116866960224362 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1897878664043237782 · Publicação no Twitter
• https://twitter.com/the_yellow_fall/status/1898188177288184218 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-0337 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1897856185295864030 · Publicação no Twitter
• https://twitter.com/pravin_karthik/status/1898388636715954491 · Publicação no Twitter
• https://t.me/purp_sec/351 · Publicação no Telegram
• https://twitter.com/zoomeye_team/status/1898717621366989283 · Publicação no Twitter
• https://twitter.com/cybercronai/status/1897712789197672921 · Publicação no Twitter