CVE-2022-43684

ACL bypass in Reporting functionality

Severity Score

6.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

ServiceNow has released patches and an upgrade that address an Access Control List (ACL) bypass issue in ServiceNow Core functionality. Additional Details This issue is present in the following supported ServiceNow releases: * Quebec prior to Patch 10 Hot Fix 8b * Rome prior to Patch 10 Hot Fix 1 * San Diego prior to Patch 7 * Tokyo prior to Tokyo Patch 1; and * Utah prior to Utah General Availability If this ACL bypass issue were to be successfully exploited, it potentially could allow an authenticated user to obtain sensitive information from tables missing authorization controls.

ServiceNow suffered from having an insecure access control that could lead to full administrative compromise. The associated link has a proof of concept.

*Credits: Luke Symons, Tony Wu, Eldar Marcussen, Gareth Phillips, Jeff Thomas, Nadeem Salim, Stephen Bradshaw

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

Single

Confidentiality

Complete

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2022-10-24 CVE Reserved
2023-06-13 CVE Published
2023-07-05 First Exploit
2024-09-17 EPSS Updated
2025-01-02 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-668: Exposure of Resource to Wrong Sphere

CAPEC

References (6)

URL	Tag	Source
http://packetstormsecurity.com/files/173354/ServiceNow-Insecure-Access-Control-Full-Admin-Compromise.html
http://seclists.org/fulldisclosure/2023/Jul/11
https://news.ycombinator.com/item?id=36638530
https://x64.sh/posts/ServiceNow-Insecure-access-control-to-admin

URL	Date	SRC
https://github.com/lolminerxmrig/CVE-2022-43684	2023-07-05

URL	Date	SRC

URL	Date	SRC
https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1303489	2023-07-11

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				quebec Search vendor "Servicenow" for product "Servicenow" and version "quebec"		patch_1_hotfix_1		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				quebec Search vendor "Servicenow" for product "Servicenow" and version "quebec"		patch_10		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				quebec Search vendor "Servicenow" for product "Servicenow" and version "quebec"		patch_10_hotfix_3		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				quebec Search vendor "Servicenow" for product "Servicenow" and version "quebec"		patch_10_hotfix_3a		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				quebec Search vendor "Servicenow" for product "Servicenow" and version "quebec"		patch_10_hotfix_3b		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				quebec Search vendor "Servicenow" for product "Servicenow" and version "quebec"		patch_10_hotfix_4		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				quebec Search vendor "Servicenow" for product "Servicenow" and version "quebec"		patch_2		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				quebec Search vendor "Servicenow" for product "Servicenow" and version "quebec"		patch_2_hotfix_1		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				quebec Search vendor "Servicenow" for product "Servicenow" and version "quebec"		patch_2_hotfix_2		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				quebec Search vendor "Servicenow" for product "Servicenow" and version "quebec"		patch_3		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				quebec Search vendor "Servicenow" for product "Servicenow" and version "quebec"		patch_4		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				quebec Search vendor "Servicenow" for product "Servicenow" and version "quebec"		patch_4_hotfix_2		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				quebec Search vendor "Servicenow" for product "Servicenow" and version "quebec"		patch_5		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				quebec Search vendor "Servicenow" for product "Servicenow" and version "quebec"		patch_6		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				quebec Search vendor "Servicenow" for product "Servicenow" and version "quebec"		patch_7		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				quebec Search vendor "Servicenow" for product "Servicenow" and version "quebec"		patch_8		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				quebec Search vendor "Servicenow" for product "Servicenow" and version "quebec"		patch_9		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				rome Search vendor "Servicenow" for product "Servicenow" and version "rome"		patch_1		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				rome Search vendor "Servicenow" for product "Servicenow" and version "rome"		patch_1_hotfix_1		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				rome Search vendor "Servicenow" for product "Servicenow" and version "rome"		patch_1_hotfix_1a		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				rome Search vendor "Servicenow" for product "Servicenow" and version "rome"		patch_1_hotfix_1b		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				rome Search vendor "Servicenow" for product "Servicenow" and version "rome"		patch_1_hotfix_2		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				rome Search vendor "Servicenow" for product "Servicenow" and version "rome"		patch_1_hotfix_3		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				rome Search vendor "Servicenow" for product "Servicenow" and version "rome"		patch_10		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				rome Search vendor "Servicenow" for product "Servicenow" and version "rome"		patch_2		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				rome Search vendor "Servicenow" for product "Servicenow" and version "rome"		patch_2_hotfix_1		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				rome Search vendor "Servicenow" for product "Servicenow" and version "rome"		patch_2_hotfix_2		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				rome Search vendor "Servicenow" for product "Servicenow" and version "rome"		patch_3		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				rome Search vendor "Servicenow" for product "Servicenow" and version "rome"		patch_3_hotfix_1		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				rome Search vendor "Servicenow" for product "Servicenow" and version "rome"		patch_4		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				rome Search vendor "Servicenow" for product "Servicenow" and version "rome"		patch_4_hotfix_1		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				rome Search vendor "Servicenow" for product "Servicenow" and version "rome"		patch_4_hotfix_1a		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				rome Search vendor "Servicenow" for product "Servicenow" and version "rome"		patch_4_hotfix_1b		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				rome Search vendor "Servicenow" for product "Servicenow" and version "rome"		patch_5		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				rome Search vendor "Servicenow" for product "Servicenow" and version "rome"		patch_5_hotfix_1		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				rome Search vendor "Servicenow" for product "Servicenow" and version "rome"		patch_5_hotfix_2		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				rome Search vendor "Servicenow" for product "Servicenow" and version "rome"		patch_6		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				rome Search vendor "Servicenow" for product "Servicenow" and version "rome"		patch_6_hotfix_1		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				rome Search vendor "Servicenow" for product "Servicenow" and version "rome"		patch_6_hotfix_2		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				rome Search vendor "Servicenow" for product "Servicenow" and version "rome"		patch_7		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				rome Search vendor "Servicenow" for product "Servicenow" and version "rome"		patch_7_hotfix_1		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				rome Search vendor "Servicenow" for product "Servicenow" and version "rome"		patch_7a		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				rome Search vendor "Servicenow" for product "Servicenow" and version "rome"		patch_7b		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				rome Search vendor "Servicenow" for product "Servicenow" and version "rome"		patch_8		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				rome Search vendor "Servicenow" for product "Servicenow" and version "rome"		patch_8_hotfix_1		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				rome Search vendor "Servicenow" for product "Servicenow" and version "rome"		patch_8_hotfix_2		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				rome Search vendor "Servicenow" for product "Servicenow" and version "rome"		patch_9		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				rome Search vendor "Servicenow" for product "Servicenow" and version "rome"		patch_9_hotfix_1		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				rome Search vendor "Servicenow" for product "Servicenow" and version "rome"		patch_9a		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				rome Search vendor "Servicenow" for product "Servicenow" and version "rome"		patch_9b		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				san_diego Search vendor "Servicenow" for product "Servicenow" and version "san_diego"		patch_1		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				san_diego Search vendor "Servicenow" for product "Servicenow" and version "san_diego"		patch_1_hotfix_1		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				san_diego Search vendor "Servicenow" for product "Servicenow" and version "san_diego"		patch_1_hotfix_1a		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				san_diego Search vendor "Servicenow" for product "Servicenow" and version "san_diego"		patch_1_hotfix_1b		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				san_diego Search vendor "Servicenow" for product "Servicenow" and version "san_diego"		patch_10_hotfix_1		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				san_diego Search vendor "Servicenow" for product "Servicenow" and version "san_diego"		patch_10_hotfix_1a		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				san_diego Search vendor "Servicenow" for product "Servicenow" and version "san_diego"		patch_10_hotfix_1b		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				san_diego Search vendor "Servicenow" for product "Servicenow" and version "san_diego"		patch_10_hotfix_2		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				san_diego Search vendor "Servicenow" for product "Servicenow" and version "san_diego"		patch_10_hotfix_2b		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				san_diego Search vendor "Servicenow" for product "Servicenow" and version "san_diego"		patch_2		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				san_diego Search vendor "Servicenow" for product "Servicenow" and version "san_diego"		patch_2_hotfix_1		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				san_diego Search vendor "Servicenow" for product "Servicenow" and version "san_diego"		patch_3		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				san_diego Search vendor "Servicenow" for product "Servicenow" and version "san_diego"		patch_3_hotfix_1		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				san_diego Search vendor "Servicenow" for product "Servicenow" and version "san_diego"		patch_3_hotfix_2		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				san_diego Search vendor "Servicenow" for product "Servicenow" and version "san_diego"		patch_3_hotfix_3		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				san_diego Search vendor "Servicenow" for product "Servicenow" and version "san_diego"		patch_3_hotfix_4		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				san_diego Search vendor "Servicenow" for product "Servicenow" and version "san_diego"		patch_4		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				san_diego Search vendor "Servicenow" for product "Servicenow" and version "san_diego"		patch_4a		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				san_diego Search vendor "Servicenow" for product "Servicenow" and version "san_diego"		patch_4b		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				san_diego Search vendor "Servicenow" for product "Servicenow" and version "san_diego"		patch_5		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				san_diego Search vendor "Servicenow" for product "Servicenow" and version "san_diego"		patch_6		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				tokyo Search vendor "Servicenow" for product "Servicenow" and version "tokyo"		-		Affected
Servicenow Search vendor "Servicenow"		Servicenow Search vendor "Servicenow" for product "Servicenow"				utah Search vendor "Servicenow" for product "Servicenow" and version "utah"		-		Affected