Data Inference in Now Platform via Conditional ACLs

A vulnerability in ServiceNow's Now Platform allows users to infer sensitive data they shouldn't access by using range queries, even when access controls are in place. This happens because certain conditional ACL configurations don't properly block these indirect data discovery attempts.

The vulnerability exploits insufficient validation in conditional ACL enforcement against range query requests, allowing both authenticated and unauthenticated users to infer instance data through inference attacks. The issue stems from improper filtering logic in query parameter handling, potentially exposing data not intended for the requester's privilege level. ServiceNow has released Query ACLs, Security Data Filters, and Deny-Unless ACL frameworks to mitigate this CWE-1220 data inference vulnerability.