Summary
ServiceNow Washington DC, Vancouver, and earlier Now Platform releases contain an incomplete list of disallowed inputs vulnerability in the GlideExpression script. An unauthenticated user could exploit this vulnerability to execute code remotely.
- Vendor
- ServiceNow
- Product
- Utah, Vancouver, and Washington DC Now Platform
- Added to KEV
- Jul 29, 2024
- Remediation due
- Aug 19, 2024 (US federal deadline)
- Ransomware use
- Not known
- Weakness
- CWE-184
- EPSS
- 99.6% as of Nov 12
In the news
- No Asia-Pacific article names this CVE yet.
Linked
Actors named alongside it:
none
Incidents exploiting it:
- none recorded
References