News for hackers. Stuff that matters.

A comment on ServiceNow Insecure Access Control to Full Admin Takeover. Parent comment

Re:ServiceNow Insecure Access Control to Full Admin Takeover by manvillej on Saturday July 08, 2023 @12:27AM (#36641339)
ServiceNow ships major upgrades twice a year and patches every month. It means that they could genuinely not figure out how to remediate this quickly and quietly without disrupting ongoing contract negotiations. It means that even with that, they couldn't fix it for a whole year.

They negotiate multiyear contracts. they're investing into government and healthcare services.

[ Parent | on HN ]
Re:ServiceNow Insecure Access Control to Full Admin Takeover by manvillej on Monday July 10, 2023 @11:17AM (#36667681)
I have to correct myself. Apparently the vulnerability was patched in San Diego patch 7 which was release on September 1st 2022. It wasn't disclosed until June 2023.

I am still mad they didn't release it as a hotfix, but that meant they couldn't sneak it under the radar.

[ Parent | on HN ]