CVE Watch—

CVE-2024-5217

ServiceNow Incomplete List of Disallowed Inputs Vulnerability

CVSS

—

No CVSS

EPSS

99.6%

p100

KEV

YES

Jul 29, 2024

Exploit Today

0-100

Published: — · Last modified: —

EPSS · 30d

99.6%EPSS · 30 days99.6%

2026-06-302026-07-16

KEV catalog record

Product

ServiceNow / Utah, Vancouver, and Washington DC Now Platform

Vulnerability

ServiceNow Incomplete List of Disallowed Inputs Vulnerability

Added to KEV

Jul 29, 2024

Remediate by

Aug 19, 2024

Known ransomware use

Summary description

ServiceNow Washington DC, Vancouver, and earlier Now Platform releases contain an incomplete list of disallowed inputs vulnerability in the GlideExpression script. An unauthenticated user could exploit this vulnerability to execute code remotely.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1648313; https://nvd.nist.gov/vuln/detail/CVE-2024-5217

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2024-4879—

100.0%

KEV—80ServiceNow Improper Input Validation Vulnerability—