Paper/Archive/CVE-2024-8923

CVE-2024-8923

ServiceNow Now Platform — Sandbox Escape in Now Platform

CVSS 10.0 (NVD)10.0 / 10 × 3030.0 Not in CISA KEV+300.0 EPSS percentile 65.9.659 × 2013.2 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

ServiceNow has addressed an input validation vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. ServiceNow deployed an update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. Further, the vulnerability is addressed in the listed patches and hot fixes.

Affected

ProductAffectedFixed inSource

Now Platform< Vancouver Patch 9 Hot Fix 2aVancouver Patch 9 Hot Fix 2aCNA

Now Platform< Vancouver Patch 10Vancouver Patch 10CNA

Now Platform< Washington DC Patch 4 Hot Fix 1aWashington DC Patch 4 Hot Fix 1aCNA

Now Platform< Washington DC Patch 5Washington DC Patch 5CNA

Now Platform< Xanadu GA ReleaseXanadu GA ReleaseCNA

servicenowVancouver – < Vancouver Patch 9 Hot Fix 2aVancouver Patch 9 Hot Fix 2aCISA-ADP

servicenowVancouver – < Vancouver Patch 10Vancouver Patch 10CISA-ADP

servicenowWashington_DC – < Washington DC Patch 4 Hot Fix 1aWashington DC Patch 4 Hot Fix 1aCISA-ADP

servicenowWashington_DC – < Washington DC Patch 5Washington DC Patch 5CISA-ADP

servicenowXanadu – < Xanadu GA ReleaseXanadu GA ReleaseCISA-ADP

Scores by source

NVD10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SN (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SN (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refsupport.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1706070