Product:
AI Platform
Summary
ServiceNow has addressed a reflected cross-site scripting vulnerability identified in the ServiceNow AI Platform. This vulnerability could allow arbitrary code execution within the browsers of users who click on a specially crafted link. A relevant security update has been deployed to most hosted instances, and updates have also been provided to self-hosted customers and partners.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.3 | CVE-2025-11449 |
Exploitation
To exploit this vulnerability, an attacker could craft a malicious link that, when clicked by a user, would execute arbitrary code in the user’s browser. This could lead to unauthorized actions being performed on behalf of the user, potentially compromising sensitive information or system integrity.
Affected Products
- ServiceNow AI Platform: Vulnerable to reflected cross-site scripting, allowing execution of arbitrary code in user browsers.
Mitigation
Customers are advised to promptly apply the relevant security updates or upgrade their systems if they have not already done so. This will help mitigate the risk associated with this vulnerability and protect against potential exploitation.