All vulnerabilities
CVE-2024-5217

ServiceNow Incomplete List of Disallowed Inputs Vulnerability

ServiceNow Utah, Vancouver, and Washington DC Now PlatformApplications & CMS
Open in ThreatlineRecord JSON
CVSS
9.2Critical
ExploitationExploited in the wildAdded to KEV 29 Jul 2024CISA KEV
Exploit odds (EPSS)99.6%Chance of exploitation activity in the next 30 days, higher than 99.9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Federal deadline19 Aug 2024Remediation due date for US federal agenciesCISA KEV
CISA required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. CISA KEV

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Timeline

  1. 10 Jul 2024, 16:28 UTCPublishedCVE List
  2. 29 Jul 2024Added to CISA KEVCISA KEV

Public exploit code and templates 1

  • Scanner templateServiceNow - Incomplete Input ValidationNuclei

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

ServiceNow Washington DC, Vancouver, and earlier Now Platform releases contain an incomplete list of disallowed inputs vulnerability in the GlideExpression script. An unauthenticated user could exploit this vulnerability to execute code remotely.

Text from CVE List

Affected versions 13

  • Now Platformaffected: all versions before Utah Patch 10 Hot Fix 3CVE List
  • Now Platformaffected: all versions before Utah Patch 10a Hot Fix 2CVE List
  • Now Platformaffected: all versions before Utah Patch 10b Hot Fix 1CVE List
  • Now Platformaffected: all versions before Vancouver Patch 6 Hot Fix 2CVE List
  • Now Platformaffected: all versions before Vancouver Patch 7 Hot Fix 3bCVE List
  • Now Platformaffected: all versions before Vancouver Patch 8 Hot Fix 4CVE List
  • Now Platformaffected: all versions before Vancouver Patch 9 Hot Fix 1CVE List
  • Now Platformaffected: all versions before Vancouver Patch 10CVE List
  • Now Platformaffected: all versions before Washington DC Patch 1 Hot Fix 3bCVE List
  • Now Platformaffected: all versions before Washington DC Patch 2 Hot Fix 2CVE List
  • Now Platformaffected: all versions before Washington DC Patch 3 Hot Fix 2CVE List
  • Now Platformaffected: all versions before Washington DC Patch 4CVE List
  • Now Platformaffected: all versions before Washington DC Patch 5CVE List

References 5