PT-2018-18598 · Servicenow · Servicenow Itsm

Published 2018-03-15 · Updated 2018-04-10 · CVE-2018-8720

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ServiceNow ITSM version 2016-06-02

Description The issue concerns a cross-site scripting (XSS) problem. It can be triggered via the First Name or Last Name field of My Profile, or the Search bar of My Portal.

Recommendations For version 2016-06-02, avoid using the First Name and Last Name fields in My Profile, and restrict access to the Search bar of My Portal until a fix is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-8720

Affected Products

Servicenow Itsm

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2018-8720 · Security Note
• https://packetstormsecurity.com/files/137427/ServiceNow-ITSM-Cross-Site-Scripting.html · Note