CVE-2025-0337 HIGH

CVE-2025-0337: Authorization bypass in Now Platform

Vendor Servicenow
Product Now Platform
Weakness CWE-639 · IDOR
Published March 6, 2025
Last update March 6, 2025

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

ServiceNow has addressed an authorization bypass vulnerability that was identified in the Washington release of the Now Platform. This vulnerability, if exploited, potentially could enable an authenticated user to access unauthorized data stored within the Now Platform that the user otherwise would not be entitled to access. This issue is addressed in the listed patches and family release, which have been made available to hosted and self-hosted customers, as well as partners.

Key dates

02Disclosure timeline

March 6, 2025 CVE published
March 6, 2025 Record updated