« Volver al listado

CVE-2025-3089

Estado: AplazadaMedia (5.3)—

ServiceNow has addressed a Broken Access Control vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could allow a low privileged user to bypass access controls and perform a limited set of actions typically reserved for higher privileged users, potentially leading to unauthorized data modifications. This issue is addressed in the listed patches and family releases, which have been made available to hosted and self-hosted customers, as well as partners.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Servicenow — AI PlatformAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-3089",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-3089",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-08-12T18:16:57.869241Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "psirt@servicenow.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 5.3,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@servicenow.com",
      "affectedData": [
        {
          "vendor": "ServiceNow",
          "product": "ServiceNow AI Platform",
          "versions": [
            {
              "status": "affected",
              "version": "Aspen",
              "lessThan": "Washington DC Patch 10 Hot Fix 2a",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "Aspen",
              "lessThan": "Xanadu Patch 7a",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "Aspen",
              "lessThan": "Xanadu Patch 8",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "Aspen",
              "lessThan": "Yokohama Patch 1a",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "Aspen",
              "lessThan": "Yokohama Patch 2",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "Aspen",
              "lessThan": "Zurich (EA)",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-08-12T16:15:27.850",
  "references": [
    {
      "url": "https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2264930",
      "source": "psirt@servicenow.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@servicenow.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "ServiceNow has addressed a Broken Access Control vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could allow a low privileged user to bypass access controls and perform a limited set of actions typically reserved for higher privileged users, potentially leading to unauthorized data modifications. This issue is addressed in the listed patches and family releases, which have been made available to hosted and self-hosted customers, as well as partners."
    },
    {
      "lang": "es",
      "value": "ServiceNow ha solucionado una vulnerabilidad de control de acceso interrumpido identificada en la plataforma de IA de ServiceNow. Esta vulnerabilidad podría permitir que un usuario con pocos privilegios eluda los controles de acceso y realice un conjunto limitado de acciones normalmente reservadas para usuarios con privilegios más altos, lo que podría provocar modificaciones no autorizadas de datos. Este problema se soluciona en los parches y versiones de la familia mencionados, que ya están disponibles para clientes alojados y autoalojados, así como para socios."
    }
  ],
  "lastModified": "2026-06-17T09:19:10.307",
  "sourceIdentifier": "psirt@servicenow.com"
}