CVE Watch—

CVE-2024-5217

ServiceNow Incomplete List of Disallowed Inputs Vulnerability

CVSS

—

Sem CVSS

EPSS

99.6%

p100

KEV

SIM

29 de jul. de 2024

Exploit Today

0-100

Publicado: — · Última mod.: —

EPSS · 30d

99.6%EPSS · 30 dias99.6%

2026-10-082026-11-05

Ficha do catálogo KEV

Produto

ServiceNow / Utah, Vancouver, and Washington DC Now Platform

Vulnerabilidade

ServiceNow Incomplete List of Disallowed Inputs Vulnerability

Adicionado ao KEV

29 de jul. de 2024

Corrigir até

19 de ago. de 2024

Uso conhecido em ransomware

Não

Descrição resumida

ServiceNow Washington DC, Vancouver, and earlier Now Platform releases contain an incomplete list of disallowed inputs vulnerability in the GlideExpression script. An unauthenticated user could exploit this vulnerability to execute code remotely.

Ação necessária

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notas

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1648313; https://nvd.nist.gov/vuln/detail/CVE-2024-5217

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2024-4879—

100.0%

KEV—80ServiceNow Improper Input Validation Vulnerability—