CVE-2024-5217: Incomplete Input Validation in GlideExpression Script

Description

ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. The vulnerability is addressed in the listed patches and hot fixes below, which were released during the June 2024 patching cycle. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)99.6% · higher than 100% of CVEs

Exploited in the wildYes

CISA KEVListed Jul 29, 2024

Federal remediation dueAug 19, 2024

Ransomware campaign useNot known

Affected products

Which versions

NP

Now Platform · ServiceNow

before Utah Patch 10 Hot Fix 3; before Utah Patch 10a Hot Fix 2; before Utah Patch 10b Hot Fix 1; before Vancouver Patch 6 Hot Fix 2; before Vancouver Patch 7 Hot Fix 3b; before Vancouver Patch 8 Hot Fix 4; +7 more · source: vendor

SE

Servicenow · Servicenow

utah; utah; utah; utah; utah; utah; +34 more · source: NVD, CISA

UV

Utah, Vancouver, and Washington DC Now Platform · ServiceNow

All versions, or not specified · source: KEV