Vulnerability · Published Jul 10, 2024 · Assigned by SN
CVE-2024-5178Incomplete Input Validation in SecurelyAccess API
Medium 4.9
In plain English
A medium-severity security flaw in Now Platform from ServiceNow. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 33.6% (higher than 98% of all known vulnerabilities).
Official description
ServiceNow has addressed a sensitive file read vulnerability that was identified in the Washington DC, Vancouver, and Utah Now Platform releases. This vulnerability could allow an administrative user to gain unauthorized access to sensitive files on the web application server. The vulnerability is addressed in the listed patches and hot fixes, which were released during the June 2024 patching cycle. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ServiceNow | Now Platform | 0 – before Utah Patch 10 Hot Fix 30 – before Utah Patch 10a Hot Fix 20 – before Utah Patch 10b Hot Fix 10 – before Vancouver Patch 6 Hot Fix 20 – before Vancouver Patch 7 Hot Fix 3b0 – before Vancouver Patch 8 Hot Fix 40 – before Vancouver Patch 9 Hot Fix 10 – before Vancouver Patch 10 |
Weakness: CWE-184 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N