Product:
AI Platform
Summary
ServiceNow has addressed a reflected cross-site scripting vulnerability identified in the ServiceNow AI Platform. This vulnerability could allow arbitrary code execution within the browsers of users who click on a specially crafted link. The issue has been mitigated through security updates deployed to hosted instances and provided to self-hosted customers and partners.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.3 | CVE-2025-11450 |
Exploitation
To exploit this vulnerability, an attacker could craft a malicious link that, when clicked by a user, executes arbitrary code in the user’s browser. This could lead to unauthorized actions being performed on behalf of the user or sensitive information being exposed.
Affected Products
- ServiceNow AI Platform: Vulnerable to reflected cross-site scripting, allowing code execution in user browsers.
Mitigation
Customers are advised to promptly apply the relevant security updates or upgrade their systems if they have not already done so. This will help protect against the reflected cross-site scripting vulnerability.