Medium severity · published Mar 6, 2025
CVE-2025-0337
Authorization bypass in Now Platform
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
ServiceNow has addressed an authorization bypass vulnerability that was identified in the Washington release of the Now Platform. This vulnerability, if exploited, potentially could enable an authenticated user to access unauthorized data stored within the Now Platform that the user otherwise would not be entitled to access. This issue is addressed in the listed patches and family release, which have been made available to hosted and self-hosted customers, as well as partners.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NP
Now Platform · ServiceNow
before Washington DC Patch 9; before Xanadu Patch 4; before Yokohama · source: vendor
Affected product
NP
Now Platform
ServiceNow
More from Now Platform
9.8
CVE-2024-5217
Incomplete Input Validation in GlideExpression Script
9.8
CVE-2024-4879
Jelly Template Injection Vulnerability in ServiceNow UI Macros
8.2
CVE-2025-3648
Data Inference in Now Platform via Conditional ACLs