CVE-2023-1298

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

ServiceNow has released upgrades and patches that address a Reflected Cross-Site scripting (XSS) vulnerability that was identified in the ServiceNow Polaris Layout. This vulnerability would enable an authenticated user to inject arbitrary scripts.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
ServiceNow	Now User Experience	< San Diego Patch 10; < Tokyo Patch 4b; < Tokyo Patch 6; < Utah Patch 1

References

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1310230Vendor Advisory
https://www.linkedin.com/in/osamay/Not Applicable
https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1310230Vendor Advisory
https://www.linkedin.com/in/osamay/Not Applicable

Timeline

Published: Jul 6, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-12998.8HashiCorp Nomad and Nomad Enterprise 1.5.0 allow a job submitter to escalate to management-level privileges using workload identity and task CVE-2023-13009.8A vulnerability classified as critical was found in SourceCodester COVID 19 Testing Management System 1.0. Affected by this vulnerability is CVE-2023-13019.8A vulnerability, which was classified as critical, has been found in SourceCodester Friendly Island Pizza Website and Ordering System 1.0. A CVE-2023-13026.1A vulnerability, which was classified as problematic, was found in SourceCodester File Tracker Manager System 1.0. This affects an unknown p CVE-2023-13039.8A vulnerability was found in UCMS 1.6 and classified as critical. This issue affects some unknown processing of the file sadmin/fileedit.php CVE-2023-13048.8An authenticated attacker can leverage an exposed getattr() method via a Jinja template to smuggle OS commands and perform other actions tha CVE-2023-13058.1An authenticated attacker can leverage an exposed “box” object to read and write arbitrary files from disk, provided those files can be pars CVE-2023-13068.8An authenticated attacker can leverage an exposed resource.db() accessor method to smuggle Python method calls via a Jinja template, which c CVE-2023-13079.8Authentication Bypass by Primary Weakness in GitHub repository froxlor/froxlor prior to 2.0.13.CVE-2023-13089.8A vulnerability classified as critical has been found in SourceCodester Online Graduate Tracer System 1.0. Affected is an unknown function o CVE-2023-13099.8A vulnerability classified as critical was found in SourceCodester Online Graduate Tracer System 1.0. Affected by this vulnerability is an u CVE-2023-13109.8A vulnerability, which was classified as critical, has been found in SourceCodester Online Graduate Tracer System 1.0. Affected by this issu