Sql injection

2018-08-0318:29:00

PRIOn knowledge base

www.prio-n.com

8.8 High

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

78.0%

JSON

report_viewer.do in ServiceNow Release Jakarta Patch 8 and earlier allows remote attackers to execute arbitrary code via ‘${xyz}’ Glide Scripting Injection in the sysparm_media parameter.

CPENameOperatorVersion
servicenoweqjakarta p1
servicenoweqjakarta p8
servicenoweqjakarta p7
servicenoweqjakarta p6a
servicenoweqjakarta p6
servicenoweqjakarta p5
servicenoweqjakarta p4
servicenoweqjakarta p3b
servicenoweqjakarta p3a
servicenoweqjakarta p3

Name	Operator	Version
servicenow	eq	jakarta p1
servicenow	eq	jakarta p8
servicenow	eq	jakarta p7
servicenow	eq	jakarta p6a
servicenow	eq	jakarta p6
servicenow	eq	jakarta p5
servicenow	eq	jakarta p4
servicenow	eq	jakarta p3b
servicenow	eq	jakarta p3a
servicenow	eq	jakarta p3