Medium severity · published Dec 2, 2024
CVE-2024-5890
HTML Injection in the Assessment plugin
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
ServiceNow has addressed an HTML injection vulnerability that was identified in the Now Platform. This vulnerability could potentially enable an unauthenticated user to modify a web page or redirect users to another website.
ServiceNow released updates to customers that addressed this vulnerability. If you have not done so already, we recommend applying security patches relevant to your instance(s) as soon as possible.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NP
Now Platform · ServiceNow
before Utah Patch 8 Hot Fix 1; before Vancouver Patch 10; before Vancouver Patch 9; before Washington DC Early Access · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-5890
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-5890
support.servicenow.com
https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1710511
More from Now Platform
9.8
CVE-2024-5217
Incomplete Input Validation in GlideExpression Script
9.8
CVE-2024-4879
Jelly Template Injection Vulnerability in ServiceNow UI Macros
10.0
CVE-2024-8923
Sandbox Escape in Now Platform
8.2
CVE-2025-3648
Data Inference in Now Platform via Conditional ACLs
7.5
CVE-2024-8924
Unauthenticated Blind SQL Injection in Core Platform