CVE-2025-0337
Medium
Description
ServiceNow has addressed an authorization bypass vulnerability that was identified in the Washington release of the Now Platform. This vulnerability, if exploited, potentially could enable an authenticated user to access unauthorized data stored within the Now Platform that the user otherwise would not be entitled to access. This issue is addressed in the listed patches and family release, which have been made available to hosted and self-hosted customers, as well as partners.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Now Platform
PublishedMar 6, 2025
First seenMar 6, 2025
How to fix
Update
- ServiceNow Now PlatformWashington DC Patch 9, Xanadu Patch 4, Yokohama or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ServiceNow Now Platform | v < Washington DC Patch 9, v < Xanadu Patch 4, v < Yokohama | Washington DC Patch 9, Xanadu Patch 4, Yokohama |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.