Description

ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. The vulnerability is addressed in the listed patches and hot fixes below, which were released during the June 2024 patching cycle. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.

Related CPE's

a

servicenow

servicenow

99

References

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1644293

Permissions Required

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1648313

Vendor Advisory

https://www.darkreading.com/cloud-security/patchnow-servicenow-critical-rce-bugs-active-exploit

Press/Media Coverage

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1644293

Permissions Required

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1648313

Vendor Advisory

https://www.darkreading.com/cloud-security/patchnow-servicenow-critical-rce-bugs-active-exploit

Press/Media Coverage

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-5217

US Government Resource

Weaknesses

[email protected]

Secondary
CWE-184

[email protected]

Primary
CWE-697

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 · Critical

Information

Source identifier

[email protected]

Vulnerability status

Analyzed

Published

2024-07-10T15:15:12.373Z

1 year ago

Last modified

2025-11-03T17:58:17.937Z

4 months ago