CVE-2024-5890mediumCWE-79

CVE-2024-5890: fallo de gravedad media en ServiceNow Now Platform

HTML Injection in the Assessment plugin

Publicada el

Seguir esta CVE+ Monitorear Now Platform

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.1epss 0.3%
ServiceNow has addressed an HTML injection vulnerability that was identified in the Now Platform. This vulnerability could potentially enable an unauthenticated user to modify a web page or redirect users to another website. ServiceNow released updates to customers that addressed this vulnerability. If you have not done so already, we recommend applying security patches relevant to your instance(s) as soon as possible.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Productos afectados
ServiceNow · Now Platform
CVEs relacionadas — ServiceNow Now Platform

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-4879CRITICALJelly Template Injection Vulnerability in ServiceNow UI MacrosEPSS 100.0%KEVCVE-2024-5217CRITICALIncomplete Input Validation in GlideExpression ScriptEPSS 99.6%KEVCVE-2024-5178MEDIUMIncomplete Input Validation in SecurelyAccess APIEPSS 33.6%CVE-2022-43684CRITICALACL bypass in Reporting functionalityEPSS 1.8%CVE-2025-3648HIGHData Inference in Now Platform via Conditional ACLsEPSS 1.7%CVE-2024-8923CRITICALSandbox Escape in Now PlatformEPSS 1.1%