Vulnerability · Published Dec 2, 2024 · Assigned by SN

CVE-2024-5890HTML Injection in the Assessment plugin

Medium 4.3

In plain English

A medium-severity cross-site scripting in Now Platform from ServiceNow. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 76.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

ServiceNow has addressed an HTML injection vulnerability that was identified in the Now Platform. This vulnerability could potentially enable an unauthenticated user to modify a web page or redirect users to another website. ServiceNow released updates to customers that addressed this vulnerability. If you have not done so already, we recommend applying security patches relevant to your instance(s) as soon as possible.

Affected products (as reported)

Vendor	Product	Versions
ServiceNow	Now Platform	0 – before Utah Patch 8 Hot Fix 10 – before Vancouver Patch 100 – before Vancouver Patch 90 – before Washington DC Early Access

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1710511