CRITICAL

CVE-2024-4879

Servicenow Servicenow 2024-07-10 CVSS v3.1

CVSS

9.8

KEV

Description

ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. ServiceNow applied an update to hosted instances, and ServiceNow released the update to our partners and self-hosted customers. Listed below are the patches and hot fixes that address the vulnerability. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.

Summary dbcve.org

A critical input validation vulnerability in ServiceNow's Now Platform (Vancouver and Washington DC releases) allows unauthenticated remote code execution within the platform context. This is a pre-authentication RCE with CVSS 9.8, indicating trivial exploitation potential.

Mitigation

Apply the ServiceNow security patches and hotfixes for your specific version immediately. For hosted instances, ServiceNow has already deployed the fix; self-hosted customers must apply the released updates.

Weakness (CWE)

CWE-1287

EPSS Score

99.98%

Probability of exploitation in next 30 days

100th percentile

References

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1644293 Permissions Required https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1645154 Vendor Advisory https://www.darkreading.com/cloud-security/patchnow-servicenow-critical-rce-bugs-active-exploit Press/Media Coverage, Third Party Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4879 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE