Lucene search
HistoryJul 10, 2024 - 5:15 p.m.
CVE-2024-5217
servicenow
input validation
vulnerability
washington dc
vancouver
now platform
unauthenticated user
code execution
patches
hot fixes
june 2024
security
instance
CVSS3
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.961
Percentile
99.5%
ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. The vulnerability is addressed in the listed patches and hot fixes below, which were released during the June 2024 patching cycle. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.
Affected configurations
Node
servicenowservicenowMatchutah-
ORservicenowservicenowMatchutahpatch_1
ORservicenowservicenowMatchutahpatch_1_hotfix_1
ORservicenowservicenowMatchutahpatch_1_hotfix_1a
ORservicenowservicenowMatchutahpatch_1_hotfix_1b
ORservicenowservicenowMatchutahpatch_1_hotfix_2
ORservicenowservicenowMatchutahpatch_10
ORservicenowservicenowMatchutahpatch_2
ORservicenowservicenowMatchutahpatch_2_hotfix_1
ORservicenowservicenowMatchutahpatch_2_hotfix_2
ORservicenowservicenowMatchutahpatch_2_hotfix_3
ORservicenowservicenowMatchutahpatch_3
ORservicenowservicenowMatchutahpatch_3_hotfix_1
ORservicenowservicenowMatchutahpatch_3_hotfix_1b
ORservicenowservicenowMatchutahpatch_4
ORservicenowservicenowMatchutahpatch_4_hotfix_2a
ORservicenowservicenowMatchutahpatch_4_hotfix_2b
ORservicenowservicenowMatchutahpatch_5
ORservicenowservicenowMatchutahpatch_6
ORservicenowservicenowMatchutahpatch_7
ORservicenowservicenowMatchutahpatch_7a
ORservicenowservicenowMatchutahpatch_7b
ORservicenowservicenowMatchutahpatch_8
ORservicenowservicenowMatchutahpatch_9
ORservicenowservicenowMatchutahpatch_9_hotfix_1a
ORservicenowservicenowMatchvancouver-
ORservicenowservicenowMatchvancouverpatch_1
ORservicenowservicenowMatchvancouverpatch_2
ORservicenowservicenowMatchvancouverpatch_2_hotfix_1a
ORservicenowservicenowMatchvancouverpatch_3
ORservicenowservicenowMatchvancouverpatch_4
ORservicenowservicenowMatchvancouverpatch_4_hotfix_1a
ORservicenowservicenowMatchvancouverpatch_4_hotfix_1b
ORservicenowservicenowMatchvancouverpatch_5
ORservicenowservicenowMatchvancouverpatch_6
ORservicenowservicenowMatchvancouverpatch_7
ORservicenowservicenowMatchvancouverpatch_7_hotfix_1a
ORservicenowservicenowMatchvancouverpatch_7_hotfix_2a
ORservicenowservicenowMatchvancouverpatch_7_hotfix_2b
ORservicenowservicenowMatchvancouverpatch_8
ORservicenowservicenowMatchwashington_dc-
ORservicenowservicenowMatchwashington_dcpatch_1
ORservicenowservicenowMatchwashington_dcpatch_1_hotfix_2a
ORservicenowservicenowMatchwashington_dcpatch_2
ORservicenowservicenowMatchwashington_dcpatch_3
| Vendor | Product | Version | CPE |
|---|---|---|---|
| servicenow | servicenow | utah | cpe:2.3:a:servicenow:servicenow:utah:-:*:*:*:*:*:* |
| servicenow | servicenow | utah | cpe:2.3:a:servicenow:servicenow:utah:patch_1:*:*:*:*:*:* |
| servicenow | servicenow | utah | cpe:2.3:a:servicenow:servicenow:utah:patch_1_hotfix_1:*:*:*:*:*:* |
| servicenow | servicenow | utah | cpe:2.3:a:servicenow:servicenow:utah:patch_1_hotfix_1a:*:*:*:*:*:* |
| servicenow | servicenow | utah | cpe:2.3:a:servicenow:servicenow:utah:patch_1_hotfix_1b:*:*:*:*:*:* |
| servicenow | servicenow | utah | cpe:2.3:a:servicenow:servicenow:utah:patch_1_hotfix_2:*:*:*:*:*:* |
| servicenow | servicenow | utah | cpe:2.3:a:servicenow:servicenow:utah:patch_10:*:*:*:*:*:* |
| servicenow | servicenow | utah | cpe:2.3:a:servicenow:servicenow:utah:patch_2:*:*:*:*:*:* |
| servicenow | servicenow | utah | cpe:2.3:a:servicenow:servicenow:utah:patch_2_hotfix_1:*:*:*:*:*:* |
| servicenow | servicenow | utah | cpe:2.3:a:servicenow:servicenow:utah:patch_2_hotfix_2:*:*:*:*:*:* |
Related
cvelist
cvelist
CVE-2024-5217 Incomplete Input Validation in GlideExpression Script
2024-07-10 16:28:32
nuclei
nuclei
ServiceNow - Incomplete Input Validation
2024-07-11 06:48:03
vulnrichment
vulnrichment
CVE-2024-5217 Incomplete Input Validation in GlideExpression Script
2024-07-10 16:28:32
cisa_kev
cisa_kev
ServiceNow Incomplete List of Disallowed Inputs Vulnerability
2024-07-29 00:00:00
cve
cve
CVE-2024-5217
2024-07-10 17:15:12
githubexploit
githubexploit
Exploit for Improper Validation of Specified Type of Input in Servicenow
2024-08-27 03:43:28
Exploit for Improper Validation of Specified Type of Input in Servicenow
2024-09-13 01:20:34
Exploit for Improper Validation of Specified Type of Input in Servicenow
2024-07-12 13:02:47
attackerkb
attackerkb
CVE-2024-5217
2024-07-10 00:00:00
CVE-2024-4879
2024-07-10 00:00:00
impervablog
impervablog
Imperva Customers Protected Against Critical ServiceNow Vulnerability
2024-07-23 13:00:41
thn
thn
Researchers Reveal ConfusedFunction Vulnerability in Google Cloud Platform
2024-07-25 08:29:00
CVSS3
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.961
Percentile
99.5%
Related for NVD:CVE-2024-5217