description: There exists an open redirect within the response list update functionality of ServiceNow. This allows attackers to redirect users to arbitrary domains when clicking on a URL within a service-now domain.
problem types: open redirect
affected:
{
defaultStatus: unaffected
product: ServiceNow
vendor: ServiceNow
versions:
changes: [at: Tokyo Patch 3, status: unaffected], lessThan: Tokyo Patch 1b, status: affected, version: Tokyo, versionType: custom
changes: [at: San Diego Patch 9, status: unaffected], lessThan: San Diego Patch 7b, status: affected, version: San Diego, versionType: custom
changes: [at: Rome Patch 10 Hotfix 3b, status: unaffected], lessThan: Rome Patch 10 Hotfix 2b, status: affected, version: Rome, versionType: custom
lessThan: Quebec Patch 10 Hotfix 10b, status: affected, version: Quebec, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
version: 3.1
]
format: CVSS
scenarios: GENERAL
exploits: Successful exploitation of this vulnerability potentially could be used to facilitate targeted attacks such as phishing.  This may enable attackers to redirect authenticated users to domains the attackers control and cause the disclosure of sensitive information, like login credentials.