CVE-2022-43684
ACL bypass in Reporting functionality
ServiceNow has released patches and an upgrade that address an Access Control List (ACL) bypass issue in ServiceNow Core functionality.
Additional Details
This issue is present in the following supported ServiceNow releases:
- Quebec prior to Patch 10 Hot Fix 8b
- Rome prior to Patch 10 Hot Fix 1
- San Diego prior to Patch 7
- Tokyo prior to Tokyo Patch 1; and
- Utah prior to Utah General Availability
If this ACL bypass issue were to be successfully exploited, it potentially could allow an authenticated user to obtain sensitive information from tables missing authorization controls.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
ACL bypass in Reporting functionality
ServiceNow has released patches and an upgrade that address an Access Control List (ACL) bypass issue in ServiceNow Core functionality.
Additional Details
This issue is present in the following supported ServiceNow releases:
- Quebec prior to Patch 10 Hot Fix 8b
- Rome prior to Patch 10 Hot Fix 1
- San Diego prior to Patch 7
- Tokyo prior to Tokyo Patch 1; and
- Utah prior to Utah General Availability
If this ACL bypass issue were to be successfully exploited, it potentially could allow an authenticated user to obtain sensitive information from tables missing authorization controls.
- Record
CVE-2022-43684- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2022-46677
ServiceNow has released patches and an upgrade that address an Access Control List (ACL) bypass issue in ServiceNow Core functionality.
Additional Details
This issue is present in the following supported ServiceNow releases:
- Quebec prior to Patch 10 Hot Fix 8b
- Rome prior to Patch 10 Hot Fix 1
- San Diego prior to Patch 7
- Tokyo prior to Tokyo Patch 1; and
- Utah prior to Utah General Availability
If this ACL bypass issue were to be successfully exploited, it potentially could allow an authenticated user to obtain sensitive information from tables missing authorization controls.
- Record
EUVD-2022-46677- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-438x-9g8x-78p5
ServiceNow has released patches and an upgrade that address an Access Control List (ACL) bypass...
ServiceNow has released patches and an upgrade that address an Access Control List (ACL) bypass issue in ServiceNow Core functionality.
Additional Details
This issue is present in the following supported ServiceNow releases:
- Quebec prior to Patch 10 Hot Fix 8b
- Rome prior to Patch 10 Hot Fix 1
- San Diego prior to Patch 7
- Tokyo prior to Tokyo Patch 1; and
- Utah prior to Utah General Availability
If this ACL bypass issue were to be successfully exploited, it potentially could allow an authenticated user to obtain sensitive information from tables missing authorization controls.
- Record
GHSA-438x-9g8x-78p5- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-200, CWE-668
- Updated
- 2026-11-02
NVD
ServiceNow has released patches and an upgrade that address an Access Control List (ACL) bypass issue in ServiceNow Core functionality.
Additional Details
This issue is present in the following supported ServiceNow releases:
- Quebec prior to Patch 10 Hot Fix 8b
- Rome prior to Patch 10 Hot Fix 1
- San Diego prior to Patch 7
- Tokyo prior to Tokyo Patch 1; and
- Utah prior to Utah General Availability
If this ACL bypass issue were to be successfully exploited, it potentially could allow an authenticated user to obtain sensitive information from tables missing authorization controls.
- Record
CVE-2022-43684- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200, CWE-668
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-43684 is a critical vulnerability (CVSS 9.9) in Servicenow, published June 13, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.80%, the 78th percentile. No source names a fixed version.
References
support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1303489
seclists.org/fulldisclosure/2023/Jul/11
news.ycombinator.com/item?id=36638530
x64.sh/posts/ServiceNow-Insecure-access-control-to-admin
packetstormsecurity.com/files/173354/ServiceNow-Insecure-Access-Control-Full-Admin-Compromise.html
nvd.nist.gov/vuln/detail/CVE-2022-43684
github.com/advisories/GHSA-438x-9g8x-78p5