Servicenow CVE-2024-5217

CRITICAL

Incomplete List of Disallowed Inputs (CWE-184)

2024-07-10 psirt@servicenow.com

Information Disclosure Servicenow

9.2

CVSS 4.0 · Vendor: servicenow

View

Vulnerability Assessment

Weakness	CWE CWE-184 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V2 - Validation and Business Logic Input validation completeness
Impact	CVSS score of 9.2 (CRITICAL). Attack characteristics: network attack vector, low complexity, no privileges required, no user interaction not required.
Exploit ScenarioDerived	This vulnerability can be exploited remotely over the network. Successful exploitation could compromise the critical-severity affected system.

Act Now Prioritize within 24-48h. Why: CRITICAL + in CISA KEV (actively exploited), no patch available.

Exploited in the wild (CISA KEV) No patch listed yet 99.6% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

AnalysisAI

ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. Rated critical severity (CVSS 9.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Technical ContextAI · show details

This vulnerability is classified under CWE-184. ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. The vulnerability is addressed in the listed patches and hot fixes below, which were released during the June 2024 patching cycle. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible. Affected products include: Servicenow.

Know when Servicenow gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (servicenow) PRIMARY 9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (servicenow) · only source for this CVE.

CVSS VectorVendor: servicenow

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

Present

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

High

Vulnerable system: Availability

High

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

2

Added to CISA KEV

Jul 14, 2026 - 04:22 CISA

CVE Published

Jul 10, 2024 - 17:15 cve.org

CRITICAL 9.2

DescriptionCVE.org

ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. The vulnerability is addressed in the listed patches and hot fixes below, which were released during the June 2024 patching cycle. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.

Threat Intelligence Overview

EPSS Score

99.6%

Top 0% exploitable

Exploit

POC

Public exploit code exists

Data Quality

2 sources

Confidence: Low

CISA KEV

EPSS POC (1)

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV Yes

Public POC Yes

EPSS 99.6%

Patch available No

Active threat Yes

Deciding rule

CRITICAL + in CISA KEV (actively exploited), no patch available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Immediate

Exploitation· derived

Active

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact· derived

High

Priority Score

216

Low Medium High Critical

KEV: +50

EPSS: +100

CVSS: +46

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Affected Products (CPE)CVE.org

cpe:2.3:a:servicenow:servicenow:utah:-:*:*:*:*:*:*

cpe:2.3:a:servicenow:servicenow:utah:early_availability:*:*:*:*:*:*

cpe:2.3:a:servicenow:servicenow:utah:patch_1:*:*:*:*:*:*

cpe:2.3:a:servicenow:servicenow:utah:patch_1_hotfix_1:*:*:*:*:*:*

cpe:2.3:a:servicenow:servicenow:utah:patch_1_hotfix_1a:*:*:*:*:*:*

cpe:2.3:a:servicenow:servicenow:utah:patch_1_hotfix_1b:*:*:*:*:*:*

cpe:2.3:a:servicenow:servicenow:utah:patch_1_hotfix_2:*:*:*:*:*:*

cpe:2.3:a:servicenow:servicenow:utah:patch_10:*:*:*:*:*:*

cpe:2.3:a:servicenow:servicenow:utah:patch_10_hotfix_1:*:*:*:*:*:*

cpe:2.3:a:servicenow:servicenow:utah:patch_10_hotfix_2:*:*:*:*:*:*

cpe:2.3:a:servicenow:servicenow:utah:patch_10a:*:*:*:*:*:*

cpe:2.3:a:servicenow:servicenow:utah:patch_10a_hotfix_1:*:*:*:*:*:*

cpe:2.3:a:servicenow:servicenow:utah:patch_10b:*:*:*:*:*:*

cpe:2.3:a:servicenow:servicenow:utah:patch_2:*:*:*:*:*:*

cpe:2.3:a:servicenow:servicenow:utah:patch_2_hotfix_1:*:*:*:*:*:*

cpe:2.3:a:servicenow:servicenow:utah:patch_2_hotfix_2:*:*:*:*:*:*

cpe:2.3:a:servicenow:servicenow:utah:patch_2_hotfix_3:*:*:*:*:*:*

cpe:2.3:a:servicenow:servicenow:utah:patch_2_hotfix_4:*:*:*:*:*:*

cpe:2.3:a:servicenow:servicenow:utah:patch_3:*:*:*:*:*:*

cpe:2.3:a:servicenow:servicenow:utah:patch_3_hotfix_1:*:*:*:*:*:*

+ 79 more

More in Servicenow

View all

CVE-2026-6875 CRITICAL Act Now POC

Remote code execution in the ServiceNow AI Platform allows an unauthenticated attacker, under certain (unspecified) circ

CVE-2024-4879 CRITICAL Act Now POC

ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platfo

CVE-2018-7748 HIGH This Week POC

report_viewer.do in ServiceNow Release Jakarta Patch 8 and earlier allows remote attackers to execute arbitrary code via

CVE-2022-38463 MEDIUM This Month POC

ServiceNow through San Diego Patch 4b and Patch 6 allows reflected XSS in the logout functionality. Rated medium severit

CVE-2026-18885 CRITICAL Act Now

Remote code execution in the ServiceNow AI Platform lets an unauthenticated attacker, under certain unspecified circumst

CVE-2026-6876 CRITICAL Act Now

Remote code execution in ServiceNow Now Platform allows an unauthenticated attacker to escape the platform's scripting s

CVE-2026-18886 CRITICAL Act Now

Improper access control in the ServiceNow AI Platform allows an unauthenticated user, under certain circumstances, to cr

CVE-2026-74820 CRITICAL Act Now

SQL injection in the ServiceNow AI Platform allows an unauthenticated attacker, under certain conditions, to execute arb

CVE-2025-12420 CRITICAL Act Now

ServiceNow AI Platform has a user impersonation vulnerability allowing unauthenticated attackers to impersonate any user

CVE-2026-86860 CRITICAL Act Now

Missing authorization in the ServiceNow AI Platform lets unauthenticated remote attackers, under certain vendor-undisclo

CVE-2026-13016 CRITICAL Act Now

Unauthenticated SQL injection in the ServiceNow AI Platform allows remote attackers to execute arbitrary SQL statements

CVE-2024-8923 CRITICAL Act Now

ServiceNow has addressed an input validation vulnerability that was identified in the Now Platform. Rated critical sever

Same weakness CWE-184 – Incomplete List of Disallowed Inputs

View all

CVE-2026-34415 CRITICAL POC

CVE-2026-41264 CRITICAL POC

CVE-2018-7489 CRITICAL

CVE-2026-70470 CRITICAL POC

CVE-2023-2017 HIGH POC

CVE-2023-29003 HIGH POC

CVE-2021-25631 HIGH POC

CVE-2018-6383 HIGH POC

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

CVE-2021-34523 CRITICAL POC

CVE-2013-2251 CRITICAL POC

CVE-2017-5638 CRITICAL POC

CVE-2025-24813 CRITICAL POC

CVE-2025-68613 HIGH POC

CVE-2015-1701 HIGH POC

CVE-2017-0147 HIGH POC

References

Advisories & patches

ADVISORY https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1648313 REF https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1644293 REF https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-5217 REF https://www.darkreading.com/cloud-security/patchnow-servicenow-critical-rce-bugs-active-exploit

Search Externally

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy