Known Exploited Vulnerabilities July 29, 2024 · CISA KEV Catalog

CVE-2024-5217: Service Now Incomplete List of Disallowed Inputs Vulnerability

Summary: ServiceNow's Washington DC, Vancouver, and earlier Now Platform releases contain an incomplete list of disallowed inputs vulnerability in the GlideExpression script, which an unauthenticated user could exploit to execute code remotely. CISA lists CVE-2024-5217 with a remediation due date of 2024-08-19 and notes known ransomware campaign use as unknown.

Bottom line: The flaw sits in the GlideExpression script and needs no credentials to reach, so anyone who can reach the instance is a potential attacker; CISA's 2024-08-19 deadline leaves a fixed window to patch or mitigate.

Read the original at CISA KEV Catalog ↗

Topics

Vulnerabilities & Patching

Mentions

CVE-2024-5217ServiceNow

Related

CVE-2024-4879: Service Now Improper Input Validation Vulnerability Known Exploited Vulnerabilities · Jul 29, 2024

Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026

U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026