PromptRiskDBThreat intelligence atlas

CVE-2024-5217 - ServiceNow Utah, Vancouver, and Washington DC Now Platform

AI Vulnerability Context

ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. The vulnerability is addressed in the listed patches and hot fixes below, which were released during the June 2024 patching cycle. If you have not do...

Overview

A source-backed snapshot of this vulnerability.

ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. The vulnerability is addressed in the listed patches and hot fixes below, which were released during the June 2024 patching cycle. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.

CISA KEVyesWhether CISA lists this as exploited.
Techniques0AI attack methods connected to this vulnerability.
Case studies0Examples where this vulnerability is mentioned.

Vulnerability status

How serious this vulnerability is and whether it is known to be exploited.

CISA KEVCRITICAL
CVE ID
CVE-2024-5217
Vendor/project
ServiceNow
Product
Utah, Vancouver, and Washington DC Now Platform
Vulnerability name
ServiceNow Incomplete List of Disallowed Inputs Vulnerability
Date added
2024-07-29
Due date
2024-08-19
Known ransomware campaign use
Unknown
CVSS v3
9.8
CVSS v4
9.2
CWE-184

Exploit context

What the vulnerability is about.

ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. The vulnerability is addressed in the listed patches and hot fixes below, which were released during the June 2024 patching cycle. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.

Related AI techniques

AI attack methods connected to this vulnerability.

View all related techniques →
No related AI attack methods. No AI attack method is connected to this vulnerability in the current data.

Related case studies

Examples where this vulnerability is mentioned.

View all case studies →
No related case studies. No case study currently mentions this vulnerability.

Source evidence

Original public records and references for this page.

View all sources →

Original source

Original source links

Open the public records and source datasets used for this page.

NVD CVE pagehttps://nvd.nist.gov/vuln/detail/CVE-2024-5217CVE API docshttps://nvd.nist.gov/developers/vulnerabilitiesData feedshttps://nvd.nist.gov/vuln/data-feedsCataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogData repositoryhttps://github.com/cisagov/kev-dataaf854a3a-2127-422b-91ae-364da2661108https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1644293af854a3a-2127-422b-91ae-364da2661108https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1648313af854a3a-2127-422b-91ae-364da2661108https://www.darkreading.com/cloud-security/patchnow-servicenow-critical-rce-bugs-active-exploit134c704f-9b21-4f2e-91b3-4a467353bcc0https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-5217