by Kastro CVE-2024-5217
ServiceNow Now Platform — Incomplete Input Validation in GlideExpression Script
Description · from the CVE record
ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. The vulnerability is addressed in the listed patches and hot fixes below, which were released during the June 2024 patching cycle. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.
Affected
ProductAffectedFixed inSource
Now Platform< Utah Patch 10 Hot Fix 3Utah Patch 10 Hot Fix 3CNA
Now Platform< Utah Patch 10a Hot Fix 2Utah Patch 10a Hot Fix 2CNA
Now Platform< Utah Patch 10b Hot Fix 1Utah Patch 10b Hot Fix 1CNA
Now Platform< Vancouver Patch 6 Hot Fix 2Vancouver Patch 6 Hot Fix 2CNA
Now Platform< Vancouver Patch 7 Hot Fix 3bVancouver Patch 7 Hot Fix 3bCNA
Now Platform< Vancouver Patch 8 Hot Fix 4Vancouver Patch 8 Hot Fix 4CNA
Now Platform< Vancouver Patch 9 Hot Fix 1Vancouver Patch 9 Hot Fix 1CNA
Now Platform< Vancouver Patch 10Vancouver Patch 10CNA
Now Platform< Washington DC Patch 1 Hot Fix 3bWashington DC Patch 1 Hot Fix 3bCNA
Now Platform< Washington DC Patch 2 Hot Fix 2Washington DC Patch 2 Hot Fix 2CNA
Now Platform< Washington DC Patch 3 Hot Fix 2Washington DC Patch 3 Hot Fix 2CNA
Now Platform< Washington DC Patch 4Washington DC Patch 4CNA
Scores by source
SN (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SN (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total