CVE-2022-46389 - CVE House
Back to Database
Status published Medium CVE-2022-46389

Cross-Site Scripting (XSS) vulnerability found on logout functionality

Vulnerability Description

There exists a reflected XSS within the logout functionality of ServiceNow versions lower than Quebec Patch 10 Hotfix 11b, Rome Patch 10 Hotfix 3b, San Diego Patch 9, Tokyo Patch 4, and Utah GA. This enables an unauthenticated remote attacker to execute arbitrary JavaScript code in the browser-based web console.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-46389

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Bao Bui a.k.a 0xd0ff9 from VNG Security Team

References

More from ServiceNow

View All →
CVE-2025-3648
Data Inference in Now Platform via Conditional ACLs
High 8.2
CVE-2025-3089
Broken Access Control in ServiceNow AI Platform
Medium 5.3
CVE-2025-12420
Unauthenticated Privilege Escalation in ServiceNow AI Platform
Critical 9.3
CVE-2025-11450
Reflected Cross Site Scripting in ServiceNow AI Platform
Medium 5.3
CVE-2025-11449
Reflected Cross Site Scripting in ServiceNow AI Platform
Medium 5.3

Affected Vendor

Affected Software

Now Platform
Vulnerable Versions:
Quebec, Rome, San Diego, Tokyo, Utah

Timeline

Official Publish: April 17th, 2023
Last Modified: February 6th, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-79

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059.007 JavaScript
Execution
T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories
Collection
T1567 Exfiltration Over Web Service
Exfiltration
T1491.001 Defacement
Impact