Information disclosure in ServiceNow

1) Improper access control

EUVDB-ID: #VU112705

Risk: Medium

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-3648

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote user can bypass implemented security restrictions and gain unauthorized access to sensitive information. 

Mitigation

Install updates from vendor's website.

Note, it is unclear, in which versions of ServiceNow the vulnerability was fixed. 

Vulnerable software versions

ServiceNow: All versions

CPE2.3

• cpe:2.3:a:servicenow:servicenow:*:*:*:*:*:*:*:*

External links

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2046494
https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2139567
https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2256712
https://www.varonis.com/blog/counter-strike-servicenow

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.