Description

ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. The vulnerability is addressed in the listed patches and hot fixes below, which were released during the June 2024 patching cycle. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.

Related CPE's

a

servicenow

servicenow

45

References

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1644293

Permissions Required

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1648313

Vendor Advisory

https://www.darkreading.com/cloud-security/patchnow-servicenow-critical-rce-bugs-active-exploit

Press/Media Coverage

Weaknesses

[email protected]

Primary
CWE-697

[email protected]

Secondary
CWE-184

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 · Critical

  • CVSS V3.1

  • CVSS V3.0

  • CVSS V2.0

Information

Source identifier

[email protected]

Vulnerability status

Analyzed

Published

2024-07-10T17:15:12.373

3 months ago

Last modified

2024-07-30T15:20:54.727

2 months ago