Incomplete Input Validation in GlideExpression Script
Priority CRITICAL 99Exploited in the wildCWE-184Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. The vulnerability is addressed in the listed patches and hot fixes below, which were released during the June 2024 patching cycle. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.
Why it matters now
Exploitation Active In CISA KEV since 2024-07-29CISA due date 2024-08-19
EPSS 0.99628 99th percentileScored 2026-11-07
Fix Fixed Now Platform (ServiceNow): Utah Patch 10 Hot Fix 3, Utah Patch 10a Hot Fix 2, Utah Patch 10b Hot Fix 1 +10
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ServiceNow | Now Platform | before Utah Patch 10 Hot Fix 3; before Utah Patch 10a Hot Fix 2; before Utah Patch 10b Hot Fix 1; before Vancouver Patch 6 Hot Fix 2; before Vancouver Patch 7 Hot Fix 3b; before Vancouver Patch 8 Hot Fix 4; before Vancouver Patch 9 Hot Fix 1; before Vancouver Patch 10; before Washington DC Patch 1 Hot Fix 3b; before Washington DC Patch 2 Hot Fix 2; before Washington DC Patch 3 Hot Fix 2; before Washington DC Patch 4; before Washington DC Patch 5 | Utah Patch 10 Hot Fix 3, Utah Patch 10a Hot Fix 2, Utah Patch 10b Hot Fix 1, Vancouver Patch 6 Hot Fix 2, Vancouver Patch 7 Hot Fix 3b, Vancouver Patch 8 Hot Fix 4, Vancouver Patch 9 Hot Fix 1, Vancouver Patch 10, Washington DC Patch 1 Hot Fix 3b, Washington DC Patch 2 Hot Fix 2, Washington DC Patch 3 Hot Fix 2, Washington DC Patch 4, Washington DC Patch 5 | Patch available | CNA |
- Now Platform VendorServiceNow Affected before Utah Patch 10 Hot Fix 3; before Utah Patch 10a Hot Fix 2; before Utah Patch 10b Hot Fix 1; before Vancouver Patch 6 Hot Fix 2; before Vancouver Patch 7 Hot Fix 3b; before Vancouver Patch 8 Hot Fix 4; before Vancouver Patch 9 Hot Fix 1; before Vancouver Patch 10; before Washington DC Patch 1 Hot Fix 3b; before Washington DC Patch 2 Hot Fix 2; before Washington DC Patch 3 Hot Fix 2; before Washington DC Patch 4; before Washington DC Patch 5 Fixed in Utah Patch 10 Hot Fix 3, Utah Patch 10a Hot Fix 2, Utah Patch 10b Hot Fix 1, Vancouver Patch 6 Hot Fix 2, Vancouver Patch 7 Hot Fix 3b, Vancouver Patch 8 Hot Fix 4, Vancouver Patch 9 Hot Fix 1, Vancouver Patch 10, Washington DC Patch 1 Hot Fix 3b, Washington DC Patch 2 Hot Fix 2, Washington DC Patch 3 Hot Fix 2, Washington DC Patch 4, Washington DC Patch 5 Patch available CNA
CPE configurations NVD · 99
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:servicenow:servicenow:utah:-:*:*:*:*:*:* | utah | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:early_availability:*:*:*:*:*:* | utah early_availability | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:patch_1:*:*:*:*:*:* | utah patch_1 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:patch_1_hotfix_1:*:*:*:*:*:* | utah patch_1_hotfix_1 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:patch_1_hotfix_1a:*:*:*:*:*:* | utah patch_1_hotfix_1a | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:patch_1_hotfix_1b:*:*:*:*:*:* | utah patch_1_hotfix_1b | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:patch_1_hotfix_2:*:*:*:*:*:* | utah patch_1_hotfix_2 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:patch_10:*:*:*:*:*:* | utah patch_10 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:patch_10_hotfix_1:*:*:*:*:*:* | utah patch_10_hotfix_1 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:patch_10_hotfix_2:*:*:*:*:*:* | utah patch_10_hotfix_2 | Vulnerable | ServiceNow |
- cpe:2.3:a:servicenow:servicenow:utah:-:*:*:*:*:*:* Versions utah Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:early_availability:*:*:*:*:*:* Versions utah early_availability Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:patch_1:*:*:*:*:*:* Versions utah patch_1 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:patch_1_hotfix_1:*:*:*:*:*:* Versions utah patch_1_hotfix_1 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:patch_1_hotfix_1a:*:*:*:*:*:* Versions utah patch_1_hotfix_1a Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:patch_1_hotfix_1b:*:*:*:*:*:* Versions utah patch_1_hotfix_1b Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:patch_1_hotfix_2:*:*:*:*:*:* Versions utah patch_1_hotfix_2 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:patch_10:*:*:*:*:*:* Versions utah patch_10 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:patch_10_hotfix_1:*:*:*:*:*:* Versions utah patch_10_hotfix_1 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:patch_10_hotfix_2:*:*:*:*:*:* Versions utah patch_10_hotfix_2 Vulnerable ·ServiceNow
Show 89 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:servicenow:servicenow:utah:patch_10a:*:*:*:*:*:* | utah patch_10a | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:patch_10a_hotfix_1:*:*:*:*:*:* | utah patch_10a_hotfix_1 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:patch_10b:*:*:*:*:*:* | utah patch_10b | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:patch_2:*:*:*:*:*:* | utah patch_2 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:patch_2_hotfix_1:*:*:*:*:*:* | utah patch_2_hotfix_1 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:patch_2_hotfix_2:*:*:*:*:*:* | utah patch_2_hotfix_2 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:patch_2_hotfix_3:*:*:*:*:*:* | utah patch_2_hotfix_3 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:patch_2_hotfix_4:*:*:*:*:*:* | utah patch_2_hotfix_4 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:patch_3:*:*:*:*:*:* | utah patch_3 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:patch_3_hotfix_1:*:*:*:*:*:* | utah patch_3_hotfix_1 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:patch_3_hotfix_1b:*:*:*:*:*:* | utah patch_3_hotfix_1b | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:patch_4:*:*:*:*:*:* | utah patch_4 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_1:*:*:*:*:*:* | utah patch_4_hotfix_1 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_2:*:*:*:*:*:* | utah patch_4_hotfix_2 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_2a:*:*:*:*:*:* | utah patch_4_hotfix_2a | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_2b:*:*:*:*:*:* | utah patch_4_hotfix_2b | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_3:*:*:*:*:*:* | utah patch_4_hotfix_3 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_3b:*:*:*:*:*:* | utah patch_4_hotfix_3b | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_4:*:*:*:*:*:* | utah patch_4_hotfix_4 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_4b:*:*:*:*:*:* | utah patch_4_hotfix_4b | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_5:*:*:*:*:*:* | utah patch_4_hotfix_5 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:patch_5:*:*:*:*:*:* | utah patch_5 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:patch_5_hotfix_1:*:*:*:*:*:* | utah patch_5_hotfix_1 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:patch_6:*:*:*:*:*:* | utah patch_6 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:patch_6_hotfix_1:*:*:*:*:*:* | utah patch_6_hotfix_1 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:patch_6_hotfix_2:*:*:*:*:*:* | utah patch_6_hotfix_2 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:patch_7:*:*:*:*:*:* | utah patch_7 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:patch_7_hotfix_1:*:*:*:*:*:* | utah patch_7_hotfix_1 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:patch_7_hotfix_2:*:*:*:*:*:* | utah patch_7_hotfix_2 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:patch_7a:*:*:*:*:*:* | utah patch_7a | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:patch_7b:*:*:*:*:*:* | utah patch_7b | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:patch_8:*:*:*:*:*:* | utah patch_8 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:patch_8_hotfix_2:*:*:*:*:*:* | utah patch_8_hotfix_2 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:patch_9:*:*:*:*:*:* | utah patch_9 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:patch_9_hotfix_1:*:*:*:*:*:* | utah patch_9_hotfix_1 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:patch_9_hotfix_1a:*:*:*:*:*:* | utah patch_9_hotfix_1a | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:utah:patch_9_hotfix_1b:*:*:*:*:*:* | utah patch_9_hotfix_1b | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:vancouver:-:*:*:*:*:*:* | vancouver | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:vancouver:patch_1:*:*:*:*:*:* | vancouver patch_1 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:vancouver:patch_1_hotfix_1:*:*:*:*:*:* | vancouver patch_1_hotfix_1 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:vancouver:patch_2:*:*:*:*:*:* | vancouver patch_2 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix_1:*:*:*:*:*:* | vancouver patch_2_hotfix_1 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix_1a:*:*:*:*:*:* | vancouver patch_2_hotfix_1a | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix_2:*:*:*:*:*:* | vancouver patch_2_hotfix_2 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix_3:*:*:*:*:*:* | vancouver patch_2_hotfix_3 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix1a:*:*:*:*:*:* | vancouver patch_2_hotfix1a | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:vancouver:patch_3:*:*:*:*:*:* | vancouver patch_3 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:vancouver:patch_3_hotfix_1:*:*:*:*:*:* | vancouver patch_3_hotfix_1 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:vancouver:patch_3_hotfix_2:*:*:*:*:*:* | vancouver patch_3_hotfix_2 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:vancouver:patch_3_hotfix_3:*:*:*:*:*:* | vancouver patch_3_hotfix_3 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:vancouver:patch_3_hotfix_4:*:*:*:*:*:* | vancouver patch_3_hotfix_4 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:vancouver:patch_4:*:*:*:*:*:* | vancouver patch_4 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:vancouver:patch_4_hotfix_1:*:*:*:*:*:* | vancouver patch_4_hotfix_1 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:vancouver:patch_4_hotfix_1a:*:*:*:*:*:* | vancouver patch_4_hotfix_1a | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:vancouver:patch_4_hotfix_1b:*:*:*:*:*:* | vancouver patch_4_hotfix_1b | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:vancouver:patch_4_hotfix_2b:*:*:*:*:*:* | vancouver patch_4_hotfix_2b | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:vancouver:patch_5:*:*:*:*:*:* | vancouver patch_5 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:vancouver:patch_5_hotfix_1:*:*:*:*:*:* | vancouver patch_5_hotfix_1 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:vancouver:patch_6:*:*:*:*:*:* | vancouver patch_6 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:vancouver:patch_6_hotfix_1:*:*:*:*:*:* | vancouver patch_6_hotfix_1 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:vancouver:patch_7:*:*:*:*:*:* | vancouver patch_7 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_1:*:*:*:*:*:* | vancouver patch_7_hotfix_1 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_1a:*:*:*:*:*:* | vancouver patch_7_hotfix_1a | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_2:*:*:*:*:*:* | vancouver patch_7_hotfix_2 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_2a:*:*:*:*:*:* | vancouver patch_7_hotfix_2a | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_2b:*:*:*:*:*:* | vancouver patch_7_hotfix_2b | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_3a:*:*:*:*:*:* | vancouver patch_7_hotfix_3a | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_4:*:*:*:*:*:* | vancouver patch_7_hotfix_4 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotifix_1a:*:*:*:*:*:* | vancouver patch_7_hotifix_1a | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotifix_1b:*:*:*:*:*:* | vancouver patch_7_hotifix_1b | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotifix_2a:*:*:*:*:*:* | vancouver patch_7_hotifix_2a | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotifix_2b:*:*:*:*:*:* | vancouver patch_7_hotifix_2b | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:vancouver:patch_8:*:*:*:*:*:* | vancouver patch_8 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:vancouver:patch_8_hotfix_1:*:*:*:*:*:* | vancouver patch_8_hotfix_1 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:vancouver:patch_8_hotfix_2:*:*:*:*:*:* | vancouver patch_8_hotfix_2 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:vancouver:patch_8_hotfix_3:*:*:*:*:*:* | vancouver patch_8_hotfix_3 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:vancouver:patch_9:*:*:*:*:*:* | vancouver patch_9 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:washington_dc:-:*:*:*:*:*:* | washington_dc | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1:*:*:*:*:*:* | washington_dc patch_1 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1_hotfix_1:*:*:*:*:*:* | washington_dc patch_1_hotfix_1 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1_hotfix_2:*:*:*:*:*:* | washington_dc patch_1_hotfix_2 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1_hotfix_2a:*:*:*:*:*:* | washington_dc patch_1_hotfix_2a | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1_hotfix_2b:*:*:*:*:*:* | washington_dc patch_1_hotfix_2b | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:washington_dc:patch_2:*:*:*:*:*:* | washington_dc patch_2 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:washington_dc:patch_2_hotfix_1:*:*:*:*:*:* | washington_dc patch_2_hotfix_1 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:washington_dc:patch_3:*:*:*:*:*:* | washington_dc patch_3 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:washington_dc:patch_3_hotfix_1:*:*:*:*:*:* | washington_dc patch_3_hotfix_1 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:washington_dc:patch_4:*:*:*:*:*:* | washington_dc patch_4 | Vulnerable | ServiceNow |
| cpe:2.3:a:servicenow:servicenow:washington_dc:patch_5:*:*:*:*:*:* | washington_dc patch_5 | Vulnerable | ServiceNow |
- cpe:2.3:a:servicenow:servicenow:utah:patch_10a:*:*:*:*:*:* Versions utah patch_10a Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:patch_10a_hotfix_1:*:*:*:*:*:* Versions utah patch_10a_hotfix_1 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:patch_10b:*:*:*:*:*:* Versions utah patch_10b Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:patch_2:*:*:*:*:*:* Versions utah patch_2 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:patch_2_hotfix_1:*:*:*:*:*:* Versions utah patch_2_hotfix_1 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:patch_2_hotfix_2:*:*:*:*:*:* Versions utah patch_2_hotfix_2 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:patch_2_hotfix_3:*:*:*:*:*:* Versions utah patch_2_hotfix_3 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:patch_2_hotfix_4:*:*:*:*:*:* Versions utah patch_2_hotfix_4 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:patch_3:*:*:*:*:*:* Versions utah patch_3 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:patch_3_hotfix_1:*:*:*:*:*:* Versions utah patch_3_hotfix_1 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:patch_3_hotfix_1b:*:*:*:*:*:* Versions utah patch_3_hotfix_1b Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:patch_4:*:*:*:*:*:* Versions utah patch_4 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_1:*:*:*:*:*:* Versions utah patch_4_hotfix_1 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_2:*:*:*:*:*:* Versions utah patch_4_hotfix_2 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_2a:*:*:*:*:*:* Versions utah patch_4_hotfix_2a Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_2b:*:*:*:*:*:* Versions utah patch_4_hotfix_2b Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_3:*:*:*:*:*:* Versions utah patch_4_hotfix_3 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_3b:*:*:*:*:*:* Versions utah patch_4_hotfix_3b Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_4:*:*:*:*:*:* Versions utah patch_4_hotfix_4 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_4b:*:*:*:*:*:* Versions utah patch_4_hotfix_4b Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_5:*:*:*:*:*:* Versions utah patch_4_hotfix_5 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:patch_5:*:*:*:*:*:* Versions utah patch_5 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:patch_5_hotfix_1:*:*:*:*:*:* Versions utah patch_5_hotfix_1 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:patch_6:*:*:*:*:*:* Versions utah patch_6 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:patch_6_hotfix_1:*:*:*:*:*:* Versions utah patch_6_hotfix_1 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:patch_6_hotfix_2:*:*:*:*:*:* Versions utah patch_6_hotfix_2 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:patch_7:*:*:*:*:*:* Versions utah patch_7 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:patch_7_hotfix_1:*:*:*:*:*:* Versions utah patch_7_hotfix_1 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:patch_7_hotfix_2:*:*:*:*:*:* Versions utah patch_7_hotfix_2 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:patch_7a:*:*:*:*:*:* Versions utah patch_7a Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:patch_7b:*:*:*:*:*:* Versions utah patch_7b Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:patch_8:*:*:*:*:*:* Versions utah patch_8 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:patch_8_hotfix_2:*:*:*:*:*:* Versions utah patch_8_hotfix_2 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:patch_9:*:*:*:*:*:* Versions utah patch_9 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:patch_9_hotfix_1:*:*:*:*:*:* Versions utah patch_9_hotfix_1 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:patch_9_hotfix_1a:*:*:*:*:*:* Versions utah patch_9_hotfix_1a Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:utah:patch_9_hotfix_1b:*:*:*:*:*:* Versions utah patch_9_hotfix_1b Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:vancouver:-:*:*:*:*:*:* Versions vancouver Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:vancouver:patch_1:*:*:*:*:*:* Versions vancouver patch_1 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:vancouver:patch_1_hotfix_1:*:*:*:*:*:* Versions vancouver patch_1_hotfix_1 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:vancouver:patch_2:*:*:*:*:*:* Versions vancouver patch_2 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix_1:*:*:*:*:*:* Versions vancouver patch_2_hotfix_1 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix_1a:*:*:*:*:*:* Versions vancouver patch_2_hotfix_1a Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix_2:*:*:*:*:*:* Versions vancouver patch_2_hotfix_2 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix_3:*:*:*:*:*:* Versions vancouver patch_2_hotfix_3 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix1a:*:*:*:*:*:* Versions vancouver patch_2_hotfix1a Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:vancouver:patch_3:*:*:*:*:*:* Versions vancouver patch_3 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:vancouver:patch_3_hotfix_1:*:*:*:*:*:* Versions vancouver patch_3_hotfix_1 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:vancouver:patch_3_hotfix_2:*:*:*:*:*:* Versions vancouver patch_3_hotfix_2 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:vancouver:patch_3_hotfix_3:*:*:*:*:*:* Versions vancouver patch_3_hotfix_3 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:vancouver:patch_3_hotfix_4:*:*:*:*:*:* Versions vancouver patch_3_hotfix_4 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:vancouver:patch_4:*:*:*:*:*:* Versions vancouver patch_4 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:vancouver:patch_4_hotfix_1:*:*:*:*:*:* Versions vancouver patch_4_hotfix_1 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:vancouver:patch_4_hotfix_1a:*:*:*:*:*:* Versions vancouver patch_4_hotfix_1a Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:vancouver:patch_4_hotfix_1b:*:*:*:*:*:* Versions vancouver patch_4_hotfix_1b Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:vancouver:patch_4_hotfix_2b:*:*:*:*:*:* Versions vancouver patch_4_hotfix_2b Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:vancouver:patch_5:*:*:*:*:*:* Versions vancouver patch_5 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:vancouver:patch_5_hotfix_1:*:*:*:*:*:* Versions vancouver patch_5_hotfix_1 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:vancouver:patch_6:*:*:*:*:*:* Versions vancouver patch_6 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:vancouver:patch_6_hotfix_1:*:*:*:*:*:* Versions vancouver patch_6_hotfix_1 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:vancouver:patch_7:*:*:*:*:*:* Versions vancouver patch_7 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_1:*:*:*:*:*:* Versions vancouver patch_7_hotfix_1 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_1a:*:*:*:*:*:* Versions vancouver patch_7_hotfix_1a Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_2:*:*:*:*:*:* Versions vancouver patch_7_hotfix_2 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_2a:*:*:*:*:*:* Versions vancouver patch_7_hotfix_2a Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_2b:*:*:*:*:*:* Versions vancouver patch_7_hotfix_2b Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_3a:*:*:*:*:*:* Versions vancouver patch_7_hotfix_3a Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_4:*:*:*:*:*:* Versions vancouver patch_7_hotfix_4 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotifix_1a:*:*:*:*:*:* Versions vancouver patch_7_hotifix_1a Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotifix_1b:*:*:*:*:*:* Versions vancouver patch_7_hotifix_1b Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotifix_2a:*:*:*:*:*:* Versions vancouver patch_7_hotifix_2a Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotifix_2b:*:*:*:*:*:* Versions vancouver patch_7_hotifix_2b Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:vancouver:patch_8:*:*:*:*:*:* Versions vancouver patch_8 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:vancouver:patch_8_hotfix_1:*:*:*:*:*:* Versions vancouver patch_8_hotfix_1 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:vancouver:patch_8_hotfix_2:*:*:*:*:*:* Versions vancouver patch_8_hotfix_2 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:vancouver:patch_8_hotfix_3:*:*:*:*:*:* Versions vancouver patch_8_hotfix_3 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:vancouver:patch_9:*:*:*:*:*:* Versions vancouver patch_9 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:washington_dc:-:*:*:*:*:*:* Versions washington_dc Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1:*:*:*:*:*:* Versions washington_dc patch_1 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1_hotfix_1:*:*:*:*:*:* Versions washington_dc patch_1_hotfix_1 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1_hotfix_2:*:*:*:*:*:* Versions washington_dc patch_1_hotfix_2 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1_hotfix_2a:*:*:*:*:*:* Versions washington_dc patch_1_hotfix_2a Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1_hotfix_2b:*:*:*:*:*:* Versions washington_dc patch_1_hotfix_2b Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:washington_dc:patch_2:*:*:*:*:*:* Versions washington_dc patch_2 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:washington_dc:patch_2_hotfix_1:*:*:*:*:*:* Versions washington_dc patch_2_hotfix_1 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:washington_dc:patch_3:*:*:*:*:*:* Versions washington_dc patch_3 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:washington_dc:patch_3_hotfix_1:*:*:*:*:*:* Versions washington_dc patch_3_hotfix_1 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:washington_dc:patch_4:*:*:*:*:*:* Versions washington_dc patch_4 Vulnerable ·ServiceNow
- cpe:2.3:a:servicenow:servicenow:washington_dc:patch_5:*:*:*:*:*:* Versions washington_dc patch_5 Vulnerable ·ServiceNow
Remediation
- Fix · CNA Now Platform (ServiceNow) Fixed in Utah Patch 10 Hot Fix 3, Utah Patch 10a Hot Fix 2, Utah Patch 10b Hot Fix 1, Vancouver Patch 6 Hot Fix 2, Vancouver Patch 7 Hot Fix 3b, Vancouver Patch 8 Hot Fix 4, Vancouver Patch 9 Hot Fix 1, Vancouver Patch 10, Washington DC Patch 1 Hot Fix 3b, Washington DC Patch 2 Hot Fix 2, Washington DC Patch 3 Hot Fix 2, Washington DC Patch 4, Washington DC Patch 5
Timeline
- 2024-07-29 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2024-5217
- 2026-10-03 Alias added: GHSA-5xx6-pf4v-cpf2
References
More Servicenow vulnerabilities
- TI-2024-04536 Jelly Template Injection Vulnerability in ServiceNow UI Macros KEVCVSS 4.0CRITICAL 9.3
- TI-2024-08286 Sandbox Escape in Now Platform CVSS 4.0CRITICAL 9.3
- TI-2022-21442 ACL bypass in Reporting functionality CVSS 3.1CRITICAL 9.9
- TI-2024-08287 Unauthenticated Blind SQL Injection in Core Platform CVSS 4.0HIGH 8.7
- TI-2018-05591 report_viewer.do in ServiceNow Release Jakarta Patch 8 and earlier allows remote… CVSS 3.0HIGH 8.8
- TI-2021-20911 The password-reset form in ServiceNow Orlando provides different responses to invalid… CVSS 3.1MEDIUM 5.3
Sources
- CVE-2024-5217 · CVE Program
- CVE-2024-5217 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-5xx6-pf4v-cpf2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences