CVE-2024-5217criticalunder attackCWE-184

CVE-2024-5217: critical vulnerability in ServiceNow Now Platform

Incomplete Input Validation in GlideExpression Script

Published · Updated

Follow this CVE+ Monitor Now Platform+ Monitor Utah, Vancouver, and Washington DC Now Platform

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.2epss 100%
from disclosure to weapon18 days
Published on NVDJul 10
1st PoC+18d
CISA KEV+19d
Action required by CISAfederal deadline: 2024-08-19

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

ServiceNow's GlideExpression script engine fails to properly validate user input, allowing attackers without authentication to execute arbitrary code on the platform. This is critical because it exposes the entire Now Platform infrastructure to remote compromise.

Technical detail

CWE-184 (Incomplete Input Validation) in GlideExpression permits unauthenticated remote code execution via inadequately sanitized script input. The vulnerability affects Washington DC, Vancouver, and earlier releases; exploitation occurs when untrusted input reaches the script execution context without sufficient validation, resulting in arbitrary code execution with platform privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. The vulnerability is addressed in the listed patches and hot fixes below, which were released during the June 2024 patching cycle. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
ServiceNow · Now Platform
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — ServiceNow Now Platform

In the same product, most dangerous first.

CVE-2024-4879CRITICALJelly Template Injection Vulnerability in ServiceNow UI MacrosEPSS 100.0%KEVCVE-2024-5178MEDIUMIncomplete Input Validation in SecurelyAccess APIEPSS 33.6%CVE-2022-43684CRITICALACL bypass in Reporting functionalityEPSS 1.8%CVE-2025-3648HIGHData Inference in Now Platform via Conditional ACLsEPSS 1.7%CVE-2024-8923CRITICALSandbox Escape in Now PlatformEPSS 1.1%CVE-2022-46389MEDIUMCross-Site Scripting (XSS) vulnerability found on logout functionalityEPSS 0.6%