Vendor / Project: ServiceNow Product: Utah, Vancouver, and Washington DC Now Platform Description: ServiceNow Washington DC, Vancouver, and earlier Now Platform releases contain an incomplete list of disallowed inputs vulnerability in the GlideExpression script. An unauthenticated user could exploit this vulnerability to execute code remotely. Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Due Date: 2024-08-19 Ransomware Campaign Use: Unknown CWEs: CWE-184 Notes: https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1648313; https://nvd.nist.gov/vuln/detail/CVE-2024-5217
CVE-2024-5217 — ServiceNow Incomplete List of Disallowed Inputs Vulnerability
Kurzinfo
Metadaten
- Original (extern): Link oeffnen
- Veroeffentlicht: 2024-07-29 00:00 UTC
- Importiert: 2026-10-20 22:46 UTC
- CVSS: 9.8
- Quelle-ID:
cisa_kev - uid_hash:
3da0829af18b6b61e78949b57e45ef3e4815e9646b873610b6273e1bf496da50
Inhalt
Verknuepfte CVEs
| CVE-ID | Severity (Quelle) | CVSS (Quelle) | Severity (CVE.org) | CVSS (CVE.org) | EPSS | EPSS-Pctl | Veroeffentlicht (CVE.org) |
|---|---|---|---|---|---|---|---|
CRITICAL |
9.8 |
CRITICAL |
9.8 |
2024-07-10 |
Quellen-Details
| Bezeichnung | Name | Kategorie | Tags | Zielgruppe | Sprache | Feed-URL |
|---|---|---|---|---|---|---|
| CISA – Known Exploited Vulnerabilities (KEV) | threat_intel | cisa, kev | - | de | https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json |