PT-2025-9977 · Servicenow · Servicenow

Jean-Michel Huguet

+1

·

Published

2025-03-06

·

Updated

2025-05-09

·

CVE-2025-0337

CVSS v3.1

6.5

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions ServiceNow versions prior to the fixed version in the Washington release of Now Platform
Description The issue is an authorization bypass vulnerability that could enable an authenticated user to access unauthorized data stored within the Now Platform. It is estimated that over 481,000 instances may be affected.
Recommendations For versions prior to the fixed version in the Washington release of Now Platform, update to the latest patch or family release that addresses this issue. As a temporary workaround, consider restricting access to sensitive data within the Now Platform until a patch is applied.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-0337

Affected Products

Servicenow