Vulnerability · Published Oct 29, 2024 · Assigned by SN

CVE-2024-8923Sandbox Escape in Now Platform

Critical 9.8

In plain English

A critical-severity code injection in Now Platform from ServiceNow. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)1.1%top 33.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

ServiceNow has addressed an input validation vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. ServiceNow deployed an update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. Further, the vulnerability is addressed in the listed patches and hot fixes.

Affected products (as reported)

Vendor	Product	Versions
ServiceNow	Now Platform	0 – before Vancouver Patch 9 Hot Fix 2a0 – before Vancouver Patch 100 – before Washington DC Patch 4 Hot Fix 1a0 – before Washington DC Patch 50 – before Xanadu GA Release

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1706070