CVE-2022-42704

5.4 mediumEPSS 0.5%

Medium (5.4) in servicenow servicenow. EPSS 0.5% chance of exploitation in the next 30 days.

A cross-site scripting (XSS) vulnerability in Employee Service Center (esc) and Service Portal (sp) in ServiceNow Quebec, Rome, and San Diego allows remote attackers to inject arbitrary web script via the Standard Ticket Conversations widget.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 39% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2023-01-13
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

servicenow:servicenow

References

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1216141
https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1216141

Check your stack JSON