by Kastro CVE-2024-4879
ServiceNow Now Platform — Jelly Template Injection Vulnerability in ServiceNow UI Macros
Description · from the CVE record
ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. ServiceNow applied an update to hosted instances, and ServiceNow released the update to our partners and self-hosted customers. Listed below are the patches and hot fixes that address the vulnerability. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.
Affected
ProductAffectedFixed inSource
Now Platform< Utah Patch 10 Hot Fix 3Utah Patch 10 Hot Fix 3CNA
Now Platform< Utah Patch 10a Hot Fix 2Utah Patch 10a Hot Fix 2CNA
Now Platform< Vancouver Patch 6 Hot Fix 2Vancouver Patch 6 Hot Fix 2CNA
Now Platform< Vancouver Patch 7 Hot Fix 3bVancouver Patch 7 Hot Fix 3bCNA
Now Platform< Vancouver Patch 8 Hot Fix 4Vancouver Patch 8 Hot Fix 4CNA
Now Platform< Vancouver Patch 9Vancouver Patch 9CNA
Now Platform< Vancouver Patch 10Vancouver Patch 10CNA
Now Platform< Washington DC Patch 1 Hot Fix 2bWashington DC Patch 1 Hot Fix 2bCNA
Now Platform< Washington DC Patch 2 Hot Fix 2Washington DC Patch 2 Hot Fix 2CNA
Now Platform< Washington DC Patch 3 Hot Fix 1Washington DC Patch 3 Hot Fix 1CNA
Now Platform< Washington DC Patch 4Washington DC Patch 4CNA
servicenow< utah_patch_10_hot_fix_3utah_patch_10_hot_fix_3CISA-ADP
Scores by source
SN (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SN (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total