CVE-2024-5217

KEVServiceNow Incomplete List of Disallowed Inputs Vulnerability

Description

ServiceNow Washington DC, Vancouver, and earlier Now Platform releases contain an incomplete list of disallowed inputs vulnerability in the GlideExpression script. An unauthenticated user could exploit this vulnerability to execute code remotely.

ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. The vulnerability is addressed in the listed patches and hot fixes below, which were released during the June 2024 patching cycle. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.

CVSS 4.0 vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

PublishedJul 10, 2024

Last modifiedJun 17, 2026

Added to KEVJul 29, 2024

Remediation dueAug 19, 2024

References

support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1644293Permissions Required
support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1648313Vendor Advisory
darkreading.com/cloud-security/patchnow-servicenow-critical-rce-bugs-active-exploitPress/Media Coverage
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-5217US Government Resource

0 recent articles mention this CVE

Risk assessment · Critical

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 798 days
CVSS: 9.2 CRITICAL
EPSS (30-day exploit probability): 99.6% · top 1% of all CVEs
Weakness: CWE-184
Attack vector: Network, remotely reachable
Preconditions: No privileges and no user interaction

Recommended actions

1.Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.