Umbra Wiki cve cve/CVE-2024-5217
Back to wiki

CVE-2024-5217 — ServiceNow Incomplete List of Disallowed Inputs Vulnerability

provenance: imported · CVE: CVE-2024-5217

CVE-2024-5217: ServiceNow Incomplete List of Disallowed Inputs Vulnerability

CISA Known Exploited Vulnerability (KEV)

Vendor / project ServiceNow
Product Utah, Vancouver, and Washington DC Now Platform
Date added 2024-07-29
Due date 2024-08-19
Ransomware campaign use Unknown

Description

ServiceNow Washington DC, Vancouver, and earlier Now Platform releases contain an incomplete list of disallowed inputs vulnerability in the GlideExpression script. An unauthenticated user could exploit this vulnerability to execute code remotely.

Required action (CISA)

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1648313; https://nvd.nist.gov/vuln/detail/CVE-2024-5217

References

  • NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-5217
  • KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog