CRITICAL

CVE-2024-5217

Servicenow Servicenow 2024-07-10 CVSS v3.1

CVSS

9.8

KEV

Description

ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. The vulnerability is addressed in the listed patches and hot fixes below, which were released during the June 2024 patching cycle. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.

Summary dbcve.org

Input validation vulnerability in ServiceNow Now Platform (Washington DC, Vancouver, and earlier releases) that allows an unauthenticated attacker to execute remote code within the platform context. The flaw enables complete system compromise without credentials.

Mitigation

Apply the June 2024 security patches and hot fixes provided by ServiceNow for your instance version as soon as possible to remediate the unauthenticated RCE vector.

Weakness (CWE)

CWE-184

CWE-697

EPSS Score

99.63%

Probability of exploitation in next 30 days

99.9th percentile

References

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1644293 Permissions Required https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1648313 Vendor Advisory https://www.darkreading.com/cloud-security/patchnow-servicenow-critical-rce-bugs-active-exploit Press/Media Coverage https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-5217 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE