CVE-2024-5890mediumCWE-79

CVE-2024-5890: medium-severity vulnerability in ServiceNow Now Platform

HTML Injection in the Assessment plugin

Published

Follow this CVE+ Monitor Now Platform

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.1epss 0.3%
ServiceNow has addressed an HTML injection vulnerability that was identified in the Now Platform. This vulnerability could potentially enable an unauthenticated user to modify a web page or redirect users to another website. ServiceNow released updates to customers that addressed this vulnerability. If you have not done so already, we recommend applying security patches relevant to your instance(s) as soon as possible.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
ServiceNow · Now Platform
Related CVEs — ServiceNow Now Platform

In the same product, most dangerous first.

CVE-2024-4879CRITICALJelly Template Injection Vulnerability in ServiceNow UI MacrosEPSS 100.0%KEVCVE-2024-5217CRITICALIncomplete Input Validation in GlideExpression ScriptEPSS 99.6%KEVCVE-2024-5178MEDIUMIncomplete Input Validation in SecurelyAccess APIEPSS 33.6%CVE-2022-43684CRITICALACL bypass in Reporting functionalityEPSS 1.8%CVE-2025-3648HIGHData Inference in Now Platform via Conditional ACLsEPSS 1.7%CVE-2024-8923CRITICALSandbox Escape in Now PlatformEPSS 1.1%