U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

Vulnerability Change Records for CVE-2019-20768

Change History

Initial Analysis by NIST 5/12/2020 11:26:05 AM

Action Type Old Value New Value
Added CPE Configuration

								
							
							
						
OR
     *cpe:2.3:a:servicenow:it_service_management:kingston:-:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:kingston:patch_1:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:kingston:patch_10:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:kingston:patch_10-1:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:kingston:patch_10-2:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:kingston:patch_11:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:kingston:patch_12:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:kingston:patch_12-1:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:kingston:patch_12-2:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:kingston:patch_13:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:kingston:patch_14:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:kingston:patch_14-1:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:kingston:patch_2:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:kingston:patch_3:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:kingston:patch_3-1:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:kingston:patch_3-2:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:kingston:patch_3a-1:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:kingston:patch_4:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:kingston:patch_4-1:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:kingston:patch_4-2:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:kingston:patch_4-4:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:kingston:patch_5:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:kingston:patch_6:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:kingston:patch_6-1:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:kingston:patch_6-2:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:kingston:patch_6-3:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:kingston:patch_6-5:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:kingston:patch_7:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:kingston:patch_7-1:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:kingston:patch_8:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:kingston:patch_8-1:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:kingston:patch_9:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:london:-:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:london:patch_1:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:london:patch_1-2:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:london:patch_1-3:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:london:patch_2:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:london:patch_2-2:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:london:patch_2-4:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:london:patch_2-5:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:london:patch_3:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:london:patch_3-3:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:london:patch_3-4:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:london:patch_4:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:london:patch_4-1:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:london:patch_4-2:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:london:patch_4-3:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:london:patch_4-4:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:london:patch_4-5:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:london:patch_4-6:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:london:patch_5:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:london:patch_5-1:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:london:patch_6:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:london:patch_6-1:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:london:patch_6a-1:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:london:patch_6b-1:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:london:patch_7:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:madrid:-:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:madrid:patch_0-1:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:madrid:patch_1:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:madrid:patch_1-1:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:madrid:patch_1-2:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:madrid:patch_2:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:madrid:patch_3:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:madrid:patch_3-1:*:*:*:*:*:*
     *cpe:2.3:a:servicenow:it_service_management:madrid:patch_3-2:*:*:*:*:*:*
Added CVSS V2

								
							
							
						
NIST (AV:N/AC:M/Au:S/C:N/I:P/A:N)
Added CVSS V2 Metadata

								
							
							
						
Victim must voluntarily interact with attack mechanism
Added CVSS V3.1

								
							
							
						
NIST AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Added CWE

								
							
							
						
NIST CWE-79
Changed Reference Type
https://outpost24.com/blog/Responsible-disclosure-Multiple-stored-XSS-vulnerabilities-discovered-in-ServiceNow-ITSM No Types Assigned
https://outpost24.com/blog/Responsible-disclosure-Multiple-stored-XSS-vulnerabilities-discovered-in-ServiceNow-ITSM Exploit, Third Party Advisory
Changed Reference Type
https://outpost24.com/blog?tags=307 No Types Assigned
https://outpost24.com/blog?tags=307 Third Party Advisory