CISA KEV

CVE-2024-5217

ServiceNow Incomplete List of Disallowed Inputs Vulnerability

ServiceNow Washington DC, Vancouver, and earlier Now Platform releases contain an incomplete list of disallowed inputs vulnerability in the GlideExpression script. An unauthenticated user could exploit this vulnerability to execute code remotely.

VendorServiceNow

ProductUtah, Vancouver, and Washington DC Now Platform

EPSS99.6%

Added to KEVJul 29, 2024

Remediation DueAug 19, 2024

Known Ransomware UseUnknown

CWECWE-184

Required Action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

From Disclosure to Action

Know how quickly you need to move.

For CVE-2024-5217, added to the catalogue on Jul 29, 2024 with a remediation deadline of Aug 19, 2024.

Added to KEVJul 29, 2024

Seraph AlertSame day

Remediation DueAug 19, 2024

ValidationOngoing

Overdue800 days overdue

Recommended action: Apply vendor remediation guidance.

Seraph Context

Technology Watch Match

Available for technologies you monitor inside Seraph CTI.

Relevant Threat Actors

Surfaced automatically when a tracked actor is linked to this CVE.

Sector Context

Shown when this vendor/product is relevant to your industry.

Exploitation Context

Campaign and indicator context, where Seraph analysts have published it.

References

More from ServiceNow in the KEV catalogue.

CVE-2024-4879Utah, Vancouver, and Washington DC Now PlatformAdded Jul 29, 2024

Does this affect technology you run?

Declare your technology stack inside Seraph CTI and get notified the moment a KEV entry matches it.

Explore Seraph CTI Back to KEV Catalogue