CVE-2024-4879criticalunder attackCWE-1287

CVE-2024-4879: critical vulnerability in ServiceNow Now Platform

Jelly Template Injection Vulnerability in ServiceNow UI Macros

Published · Updated

Follow this CVE+ Monitor Now Platform+ Monitor Utah, Vancouver, and Washington DC Now Platform

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.3epss 100%
from disclosure to weapon2 days
Published on NVDJul 10
1st PoC+2d
CISA KEV+19d
Action required by CISAfederal deadline: 2024-08-19

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

A flaw in ServiceNow's UI Macros allows unauthenticated attackers to inject malicious code through template input, leading to remote code execution on the platform. This is critical because it bypasses authentication and affects all users of affected ServiceNow instances.

Technical detail

CWE-1287 template injection vulnerability in ServiceNow UI Macros allows unauthenticated remote code execution due to insufficient input validation. The attack vector is network-based with no authentication required; vulnerable versions of Vancouver and Washington DC Now Platform releases are affected. Successful exploitation results in arbitrary code execution within the Now Platform context.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. ServiceNow applied an update to hosted instances, and ServiceNow released the update to our partners and self-hosted customers. Listed below are the patches and hot fixes that address the vulnerability. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
ServiceNow · Now Platform
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — ServiceNow Now Platform

In the same product, most dangerous first.

CVE-2024-5217CRITICALIncomplete Input Validation in GlideExpression ScriptEPSS 99.6%KEVCVE-2024-5178MEDIUMIncomplete Input Validation in SecurelyAccess APIEPSS 33.6%CVE-2022-43684CRITICALACL bypass in Reporting functionalityEPSS 1.8%CVE-2025-3648HIGHData Inference in Now Platform via Conditional ACLsEPSS 1.7%CVE-2024-8923CRITICALSandbox Escape in Now PlatformEPSS 1.1%CVE-2022-46389MEDIUMCross-Site Scripting (XSS) vulnerability found on logout functionalityEPSS 0.6%