CVE-2025-0337 Authorization bypass in Now Platform
An authenticated user can bypass authorization controls to access unauthorized data within the ServiceNow Now Platform.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-0337?
CVE-2025-0337 is a high-severity missing authorization vulnerability in ServiceNow Now Platform, published on 6 Mar 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
ServiceNow has addressed an authorization bypass vulnerability that was identified in the Washington release of the Now Platform. This vulnerability, if exploited, potentially could enable an authenticated user to access unauthorized data stored within the Now Platform that the user otherwise would not be entitled to access.
This issue is addressed in the listed patches and family release, which have been made available to hosted and self-hosted customers, as well as partners.
Weakness: CWE-639
Which versions are affected by CVE-2025-0337?
How do I fix CVE-2025-0337?
No fix has been published for CVE-2025-0337 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-0337 being exploited?
There is no known exploitation of CVE-2025-0337 in the wild and no public exploit code.
Sources
Also known as GHSA-4x8m-chwm-9h7p.