CVE-2025-3648

Data Inference in Now Platform via Conditional ACLs

View on CVE.org
Published Jul 8, 2025 CVSS 4.0 · 8.2 High EPSS 1.7% KEV · Not listed
Description
A vulnerability has been identified in the Now Platform that could result in data being inferred without authorization. Under certain conditional access control list (ACL) configurations, this vulnerability could enable unauthenticated and authenticated users to use range query requests to infer instance data that is not intended to be accessible to them.

To assist customers in enhancing access controls, ServiceNow has introduced additional access control frameworks in Xanadu and Yokohama, such as Query ACLs, Security Data Filters and Deny-Unless ACLs.

Additionally, in May 2025, ServiceNow delivered to customers a security update that is designed to enhance customer ACL configurations.

Customers, please review the KB Articles in the References section.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-20522 A vulnerability has been identified in the Now Platform that could result in data being inferred without authorization. Under certain conditional access control list (ACL) configurations, this vulnerability could enable unauthenticated and authenticated users to use range query requests to infer instance data that is not intended to be accessible to them. To assist customers in enhancing access controls, ServiceNow has introduced additional access control frameworks in Xanadu and Yokohama, such as Query ACLs, Security Data Filters and Deny-Unless ACLs. Additionally, in May 2025, ServiceNow delivered to customers a security update that is designed to enhance customer ACL configurations. Customers, please review the KB Articles in the References section.
History
Type Values Removed Values Added
Metrics epss

{'score': 0.00051}

 epss

{'score': 0.00039}
Type Values Removed Values Added
Metrics epss

{'score': 0.00039}

 epss

{'score': 0.00051}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability has been identified in the Now Platform that could result in data being inferred without authorization. Under certain conditional access control list (ACL) configurations, this vulnerability could enable unauthenticated and authenticated users to use range query requests to infer instance data that is not intended to be accessible to them. To assist customers in enhancing access controls, ServiceNow has introduced additional access control frameworks in Xanadu and Yokohama, such as Query ACLs, Security Data Filters and Deny-Unless ACLs. Additionally, in May 2025, ServiceNow delivered to customers a security update that is designed to enhance customer ACL configurations. Customers, please review the following KB Articles for further guidance: * (Requires NowSupport login) https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2046494 * (Requires NowSupport login) https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2256712 * https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2139567 A vulnerability has been identified in the Now Platform that could result in data being inferred without authorization. Under certain conditional access control list (ACL) configurations, this vulnerability could enable unauthenticated and authenticated users to use range query requests to infer instance data that is not intended to be accessible to them. To assist customers in enhancing access controls, ServiceNow has introduced additional access control frameworks in Xanadu and Yokohama, such as Query ACLs, Security Data Filters and Deny-Unless ACLs. Additionally, in May 2025, ServiceNow delivered to customers a security update that is designed to enhance customer ACL configurations. Customers, please review the KB Articles in the References section.
References
Type Values Removed Values Added
Description A vulnerability has been identified in the Now Platform that could result in data being inferred without authorization. Under certain conditional access control list (ACL) configurations, this vulnerability could enable unauthenticated and authenticated users to use range query requests to infer instance data that is not intended to be accessible to them. To assist customers in enhancing access controls, ServiceNow has introduced additional access control frameworks in Xanadu and Yokohama, such as Query ACLs, Security Data Filters and Deny-Unless ACLs. Additionally, in May 2025, ServiceNow delivered to customers a security update that is designed to enhance customer ACL configurations. Customers, please review the following KB Articles for further guidance: * (Requires NowSupport login) https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2046494 * (Requires NowSupport login) https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2256712 * https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2139567
Title Data Inference in Now Platform via Conditional ACLs
Weaknesses CWE-1220
References
Metrics cvssV4_0

{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

Weaknesses

Sources

Status
PUBLISHED
Assigner
SN
Published
Updated
Aug 19, 2025, 6:37 PM
Reserved
Apr 15, 2025, 1:30 PM

View source JSON

Updated
Jul 8, 2025, 8:36 PM

JSON

Status
Deferred
Published
Jul 8, 2025, 4:15 PM
Modified
Jun 17, 2026, 9:20 AM

View source JSON

No data.

No data.