AI description
CVE-2025-3648 is a vulnerability in the Now Platform that could allow unauthorized data inference. It stems from conditional access control list (ACL) configurations. Unauthenticated and authenticated users could exploit this vulnerability using range query requests to infer instance data that they should not have access to. The vulnerability impacts the record count UI element on list pages. By exploiting this, malicious actors could gain unauthorized access to sensitive information, including personally identifiable information (PII) and credentials. ServiceNow has introduced additional access control frameworks and a security update in May 2025 to help customers enhance access controls.
- Description
- A vulnerability has been identified in the Now Platform that could result in data being inferred without authorization. Under certain conditional access control list (ACL) configurations, this vulnerability could enable unauthenticated and authenticated users to use range query requests to infer instance data that is not intended to be accessible to them. To assist customers in enhancing access controls, ServiceNow has introduced additional access control frameworks in Xanadu and Yokohama, such as Query ACLs, Security Data Filters and Deny-Unless ACLs. Additionally, in May 2025, ServiceNow delivered to customers a security update that is designed to enhance customer ACL configurations. Customers, please review the following KB Articles for further guidance: * (Requires NowSupport login) https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2046494 * (Requires NowSupport login) https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2256712 * https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2139567
- Source
- psirt@servicenow.com
- NVD status
- Awaiting Analysis
CVSS 4.0
- Type
- Secondary
- Base score
- 8.2
- Impact score
- -
- Exploitability score
- -
- Vector string
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity
- HIGH
- psirt@servicenow.com
- CWE-1220
- Hype score
- Not currently trending
ServiceNow AI Platformの脆弱性(CVE-2025-3648)発見への貢献がクレジットされました！ 日々関わるServiceNowのセキュリティに貢献でき、ServiceNowエンジニアとしてとても光栄です。 今回の貢献を認めてくれたServiceNowに深
@mio_yokohama
19 Aug 2025
618 Impressions
2 Retweets
13 Likes
0 Bookmarks
3 Replies
0 Quotes
ServiceNow Flaw CVE-2025-3648 Could Lead to Data Exposure via Misconfigured ACLs #CISO https://t.co/VYLiMcljtK https://t.co/MSXVJR54fE
@compuchris
24 Jul 2025
29 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
ServiceNowにCount(er) Strike脆弱性（CVE-2025-3648） ・ Varonis Threat Labsが発見した高重要度のデータ推論脆弱性 ・ 列挙とフィルタという正規の機能とレコードカウントUIを悪用し、機密データを推論 ・ PII、認証情報、
@taksasDESUYO
18 Jul 2025
176 Impressions
0 Retweets
7 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2025-3648:vulnerability in the Now Platform could result in data being inferred without authorization. this vulnerability could enable unauthenticated and authenticated users to use range query requests to infer instance data that is not intended to be accessible to them
@ZeroDayFacts
16 Jul 2025
11 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
.@ServiceNow issued a CVE for a high-severity vulnerability — CVE-2025-3648 — that could lead to significant data exposure. It underscored that it issued patches in September 2024 and March 2025 to address the issue. #cybersecurity #infosec #ITsecurity https://t.co/OC187nYY2
@SCMagazine
14 Jul 2025
585 Impressions
0 Retweets
1 Like
1 Bookmark
0 Replies
0 Quotes
ServiceNow Flaw CVE-2025-3648 Could Lead to Data Exposure via Misconfigured ACLs #CISO https://t.co/UCXBE7FH4m https://t.co/SNQblTylCD
@compuchris
13 Jul 2025
23 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
.@ServiceNow issued a CVE for a high-severity vulnerability — CVE-2025-3648 — that could lead to significant data exposure. It underscored that it issued patches in September 2024 and March 2025 to address the issue. #cybersecurity #infosec #ITsecurity https://t.co/OC187nYY2
@SCMagazine
13 Jul 2025
831 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
ServiceNow Flaw CVE-2025-3648 Could Lead to Data Exposure via Misconfigured ACLs https://t.co/kUG5tXduyM #patchmanagement
@eyalestrin
12 Jul 2025
18 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🚨 ServiceNow bug exposed sensitive data! A critical flaw (CVE-2025-3648) let attackers infer private info — no admin access needed. Even anonymous users could snoop! Details: https://t.co/kuZOuyP5Is #CyberSecurity #DataBreach #CyberAlert #skyhunter https://t.co/SEFHxlucL
@Skyhunter_A7
11 Jul 2025
15 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
A tiny ServiceNow ACL slip could leak data like an open vault! 🚨🚨CVE-2025-3648 (CVSS 8.2) lets anyone—auth or not—sneak peeks at restricted data with clever range queries. Search by vul.cve Filter👉vul.cve="CVE-2025-3648" ZoomEye Dork👉app="ServiceNow" Over 635.6
@zoomeye_team
11 Jul 2025
851 Impressions
3 Retweets
15 Likes
7 Bookmarks
0 Replies
0 Quotes
A tiny ServiceNow ACL slip could leak data like an open vault! 🚨🚨CVE-2025-3648 (CVSS 8.2) lets anyone—auth or not—sneak peeks at restricted data with clever range queries. Search by vul.cve Filter👉vul.cve="CVE-2025-3648" ZoomEye Dork👉app="ServiceNow" Over 635.6
@zoomeye_team
11 Jul 2025
29 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
ServiceNow Flaw Could Lead to Data Exposure via Misconfigured ACLs if successfully exploited. CVE-2025-3648 (CVSS score: 8.2), has been described as a case of data inference in Now Platform through conditional access control list (ACL) rules. https://t.co/rkp1A9YC9I https://t.co
@riskigy
11 Jul 2025
52 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
⚠️ Urgent warning for ServiceNow admins! CVE-2025-3648 allows data exposure via misconfigured ACLs. Secure your instances ASAP! #DataSecurity #CVE https://t.co/k0EJlGqOpA
@xcybersecnews
10 Jul 2025
40 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🚨 Critical ServiceNow flaw CVE-2025-3648 could expose enterprise data! CVSS 8.2 severity. Exploitable with minimal privileges. ServiceNow released fixes. Enterprise customers: apply security guardrails NOW! 🛡️ #ServiceNow #Cybersecurity #TechNews https://t.co/FdbdmiMkO
@BiztechNarrator
10 Jul 2025
0 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🚨 Critical "Count(er) Strike" vulnerability (CVE-2025-3648) discovered in ServiceNow platform allows attackers to steal sensitive data including PII, credentials & financial info. Exploits record count UI elements, requires minimal access, and can be used by weak/anonymo
@threatcluster
10 Jul 2025
4 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
ServiceNow #flaw #CVE-2025-3648 Could Lead to Data Exposure via Misconfigured ACLs https://t.co/9sUKanfTsA
@AdliceSoftware
10 Jul 2025
24 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
آسیبپذیری شدید امنیتی در پلتفرم ServiceNow کشف شد که در صورت سوءاستفاده موفقیتآمیز، میتواند منجر به افشای اطلاعات و سرقت داده شود. این آسیبپذیری با شناس
@Teeegra
10 Jul 2025
88 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
A new vulnerability in ServiceNow, identified as CVE-2025-3648, allows low-privileged users to extract sensitive data due to misconfigured Access Control Lists (ACLs). https://t.co/fN4IfowbHs
@securityRSS
10 Jul 2025
17 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
ServiceNow Flaw Could Lead to Data Exposure via Misconfigured ACLs CVE-2025-3648 (CVSS 8.2) dubbed Count(er) Strike a critical flaw in ServiceNow's platform that allows unauthorized users to infer sensitive data via misconfigured ACLs. Exploited through range queries, even https
@dCypherIO
10 Jul 2025
34 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
ServiceNow Flaw CVE-2025-3648 Could Lead to Data Exposure via Misconfigured ACLs - https://t.co/q251UJhaum #could #lead #exposure
@cyntelnext
10 Jul 2025
31 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
ServiceNow Flaw CVE-2025-3648 Could Lead to Data Exposure via Misconfigured ACLs https://t.co/5dfLC5VqKR https://t.co/VzUO2GMZpS
@talentxfactor
10 Jul 2025
39 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
📌 تم الكشف عن ثغرة أمنية عالية الخطورة في منصة ServiceNow، تُعرف بـ CVE-2025-3648، قد تؤدي إلى تعرض البيانات وسرقتها بسبب تكوين خاطئ لقوائم التحكم بالوصول. تُصنف ال
@Cybercachear
10 Jul 2025
62 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
ServiceNow Flaw CVE-2025-3648 Could Lead to Data Exposure via Misconfigured ACLs https://t.co/LCuI9ok9PM
@molari999
10 Jul 2025
20 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
ServiceNow Flaw CVE-2025-3648 Could Lead to Data Exposure via Misconfigured ACLs https://t.co/8TQaTS9LuL https://t.co/oHr1iF6n77
@RigneySec
10 Jul 2025
46 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
🚨 Major flaws hit ServiceNow, Lenovo, and Windows: 🔸 ServiceNow bug (CVE-2025-3648) leaks PII via ACL misconfigs—no login needed 🔸 Lenovo app lets local users hijack DLLs to run code 🔸 Windows Kerberos bug (CVE-2025-47978) can crash domain controllers remotely Fin
@TheHackersNews
10 Jul 2025
64952 Impressions
37 Retweets
98 Likes
23 Bookmarks
1 Reply
0 Quotes
🚨 ServiceNow patches critical ACL vulnerability (CVE-2025-3648) that could expose sensitive data. Admins, update your systems and review access controls now! 🔐 Details: https://t.co/97AwdZXj7l #Cybersecurity #ServiceNow[](https://t.co/97AwdZXj7l)
@_F2po_
10 Jul 2025
30 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
⚠️Count(er) Strike：ServiceNowの脆弱性により、制限されたデータの列挙が可能に（CVE-2025-3648） 〜サイバーアラート7月10日〜 https://t.co/KbKXER8HqI #セキュリティ #インテリジェンス #OSINT
@MachinaRecord
10 Jul 2025
20 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes