CVE-2021-45901

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The password-reset form in ServiceNow Orlando provides different responses to invalid authentication attempts depending on whether the username exists.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-203

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/165989/ServiceNow-Orlando-Username-Enumeration.htmlExploit, Third Party Advisory
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/servicenow-username-enumeration-vulnerability-cve-2021-45901/Exploit, Third Party Advisory
https://www.trustwave.com/en-us/resources/security-resources/security-advisories/Vendor Advisory
http://packetstormsecurity.com/files/165989/ServiceNow-Orlando-Username-Enumeration.htmlExploit, Third Party Advisory
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/servicenow-username-enumeration-vulnerability-cve-2021-45901/Exploit, Third Party Advisory
https://www.trustwave.com/en-us/resources/security-resources/security-advisories/Vendor Advisory

Timeline

Published: Feb 10, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-459036.1A persistent cross-site scripting (XSS) issue in the web interface of SuiteCRM before 7.10.35, and 7.11.x and 7.12.x before 7.12.2, allows a CVE-2021-459045.4OpenWrt 21.02.1 allows XSS via the Port Forwards Add Name screen.CVE-2021-459055.4OpenWrt 21.02.1 allows XSS via the Traffic Rules Name screen.CVE-2021-459065.4OpenWrt 21.02.1 allows XSS via the NAT Rules Name screen.CVE-2021-459077.8An issue was discovered in gif2apng 1.9. There is a stack-based buffer overflow involving a for loop. An attacker has little influence over CVE-2021-459087.8An issue was discovered in gif2apng 1.9. There is a stack-based buffer overflow involving a while loop. An attacker has little influence ove CVE-2021-459097.8An issue was discovered in gif2apng 1.9. There is a heap-based buffer overflow vulnerability in the DecodeLZW function. It allows an attacke CVE-2021-459107.8An issue was discovered in gif2apng 1.9. There is a heap-based buffer overflow within the main function. It allows an attacker to write data CVE-2021-459117.8An issue was discovered in gif2apng 1.9. There is a heap-based buffer overflow in the main function. It allows an attacker to write 2 bytes CVE-2021-459127.8An unauthenticated Named Pipe channel in Controlup Real-Time Agent (cuAgent.exe) before 8.5 potentially allows an attacker to run OS command CVE-2021-459137.2A hardcoded key in ControlUp Real-Time Agent (cuAgent.exe) before 8.2.5 may allow a potential attacker to run OS commands via a WCF channel.CVE-2021-459149.8In LuxSoft LuxCal Web Calendar before 5.2.0, an unauthenticated attacker can manipulate a POST request. This allows the attacker's session t