CVE-2025-3648: high-severity vulnerability in ServiceNow Now Platform
Data Inference in Now Platform via Conditional ACLs
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A vulnerability in ServiceNow's Now Platform allows users to infer sensitive data they shouldn't access by using range queries, even when access controls are in place. This happens because certain conditional ACL configurations don't properly block these indirect data discovery attempts.
The vulnerability exploits insufficient validation in conditional ACL enforcement against range query requests, allowing both authenticated and unauthenticated users to infer instance data through inference attacks. The issue stems from improper filtering logic in query parameter handling, potentially exposing data not intended for the requester's privilege level. ServiceNow has released Query ACLs, Security Data Filters, and Deny-Unless ACL frameworks to mitigate this CWE-1220 data inference vulnerability.
In the same product, most dangerous first.