Critical · published June 13, 2023
🚨 A sneaky bypass in ServiceNow's access controls could let nosy users peek into sensitive data like it’s an open diary! 🔥 Think of this as a hotel with guest rooms that forgot to lock their doors. Anyone with a keycard could just wander in and read your private notes without your knowledge! If this ACL bypass vulnerability is exploited, an authenticated user could gain access to sensitive information from tables that should be off-limits. Imagine your secrets being revealed as if someone flipped through your private journal—absolutely devastating!
Think of this as a hotel with guest rooms that forgot to lock their doors. Anyone with a keycard could just wander in and read your private notes without your knowledge! This issue allows authenticated users to bypass Access Control Lists (ACLs), meaning they can access data that should require special permissions to view. It's a critical flaw in the core functionality of ServiceNow releases like Quebec, Rome, San Diego, and others.
If this ACL bypass vulnerability is exploited, an authenticated user could gain access to sensitive information from tables that should be off-limits. Imagine your secrets being revealed as if someone flipped through your private journal—absolutely devastating! To secure your systems, apply the latest patches: update Quebec to Patch 10 Hot Fix 8b, Rome to Patch 10 Hot Fix 1, and San Diego to Patch 7. For Tokyo and Utah, make sure to upgrade to the latest patches as well! You've got this! Follow these steps, and you'll have your ServiceNow environment locked down in no time! 🛡️