medium5.3Public exploit code
CVE-2021-45901
The password-reset form in ServiceNow Orlando provides different responses to invalid authentication attempts depending on whether the username exists.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- ServiceNow - Username Enumeration2022-02-16 · webapps · multiple
Impact
The password-reset form in ServiceNow Orlando provides different responses to invalid authentication attempts depending on whether the username exists.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Servicenow | Servicenow | Version jakarta |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/165989/ServiceNow-Orlando-Username-Enumeration.html
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/servicenow-username-enumeration-vulnerability-cve-2021-45901/
- https://www.trustwave.com/en-us/resources/security-resources/security-advisories/
- http://packetstormsecurity.com/files/165989/ServiceNow-Orlando-Username-Enumeration.html
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/servicenow-username-enumeration-vulnerability-cve-2021-45901/
- https://www.trustwave.com/en-us/resources/security-resources/security-advisories/