Skip to main content

Servicenow CVE-2018-7748

HIGH
Code Injection (CWE-94)
2018-08-03 cve@mitre.org
Code Injection RCE Servicenow
8.8
CVSS 3.0 · NVD
Share

Severity by source

NVD PRIMARY
8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Aug 03, 2018 - 18:29 nvd
HIGH 8.8

DescriptionNVD

report_viewer.do in ServiceNow Release Jakarta Patch 8 and earlier allows remote attackers to execute arbitrary code via '${xyz}' Glide Scripting Injection in the sysparm_media parameter.

AnalysisAI

report_viewer.do in ServiceNow Release Jakarta Patch 8 and earlier allows remote attackers to execute arbitrary code via '${xyz}' Glide Scripting Injection in the sysparm_media parameter. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Code Injection (CWE-94), which allows attackers to inject and execute arbitrary code within the application. report_viewer.do in ServiceNow Release Jakarta Patch 8 and earlier allows remote attackers to execute arbitrary code via '${xyz}' Glide Scripting Injection in the sysparm_media parameter. Affected products include: Servicenow.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Never evaluate user-controlled input as code. Use sandboxing, disable dangerous functions, apply strict input validation.

More in Servicenow

View all
CVE-2024-4879 CRITICAL POC
9.3 Jul 10

ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platfo
CVE-2024-5217 CRITICAL POC
9.2 Jul 10

ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earl
CVE-2022-38463 MEDIUM POC
6.1 Aug 23

ServiceNow through San Diego Patch 4b and Patch 6 allows reflected XSS in the logout functionality. Rated medium severit
CVE-2024-8923 CRITICAL
9.3 Oct 29

ServiceNow has addressed an input validation vulnerability that was identified in the Now Platform. Rated critical sever
CVE-2024-8924 HIGH
8.7 Oct 29

ServiceNow has addressed a blind SQL injection vulnerability that was identified in the Now Platform. Rated high severit
CVE-2023-1298 MEDIUM
6.1 Jul 06

ServiceNow has released upgrades and patches that address a Reflected Cross-Site scripting (XSS) vulnerability that was

CVE-2022-38172 MEDIUM
6.1 Aug 23

ServiceNow through San Diego Patch 3 allows XSS via the name field during creation of a new dashboard for the Performanc
CVE-2023-1209 MEDIUM
5.4 May 23

Cross-Site Scripting (XSS) vulnerabilities exist in ServiceNow records allowing an authenticated attacker to inject arbi

Same weakness CWE-94 – Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2013-3906 HIGH POC
7.8
CVE-2017-9822 HIGH POC
8.8
CVE-2018-1273 CRITICAL POC
9.8
CVE-2025-32432 CRITICAL POC
10.0

Same technique Code Injection

View all
CVE-2012-0158 HIGH POC
8.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-3906 HIGH POC
7.8
CVE-2017-9822 HIGH POC
8.8
CVE-2018-1273 CRITICAL POC
9.8

Share

CVE-2018-7748 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy